中文 EN
Start Review
Skill Trust Decision

rotifer-self-evolving-agent

Rotifer技能存在供应链风险和权限声明不完整的双重问题：通过npx动态执行远程npm包，且权限声明(network:outbound)未反映filesystem和code_execution实际需求

Install decision first Source: ClawHub Scanned: 14 hr ago
Files 5
Artifacts 10
Violations 4
Findings 5
Most direct threat evidence
01
通过SKILL.md伪装成性能优化工具 Entry · SKILL.md
02
通过npx执行远程npm包引入供应链风险 Entry · SKILL.md
03
install_gene将第三方Gene代码写入~/.rotifer/ Escalation · SKILL.md

Why this conclusion was reached

2/4 dimensions flagged
Block
Declared vs actual capability

4 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

10 lower-risk artifacts were extracted and still need context.

Block
Attack chain and severe findings

The report includes 4 attack-chain steps and 2 severe findings.

Review
Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

Attack Chain

01
通过SKILL.md伪装成性能优化工具

Entry · SKILL.md:1

02
通过npx执行远程npm包引入供应链风险

Entry · SKILL.md:19

03
install_gene将第三方Gene代码写入~/.rotifer/

Escalation · SKILL.md:32

04
agent_run执行不可信的第三方代码(即使有沙箱)

Impact · SKILL.md:53

What drove the risk score up

供应链风险-npx动态执行 +15

通过npx @rotifer/[email protected]从npm动态拉取并执行远程代码，非纯本地逻辑

权限声明不完整 +12

clawhub.json声明network:outbound但实际需要filesystem:WRITE(安装Gene)和code_execution(执行Agent)

代码执行能力 +10

install_gene将第三方代码写入~/.rotifer/；agent_run执行这些代码，虽声称WASM沙箱但SKILL.md未充分说明限制

数据外传 +5

登录用户上报使用遥测数据到Rotifer Cloud(工具名/GeneID/延迟/用户ID)，虽声称不含敏感信息但仍属数据外传

Most important evidence

High Supply Chain

通过npx动态执行远程npm包

SKILL.md声明运行时依赖@rotifer/[email protected]通过npx从npm动态拉取并执行。这是供应链攻击的高风险向量，npm包可能被篡改或存在恶意依赖。

SKILL.md:19
建议使用本地安装的MCP服务器或提供npm包hash校验机制
High Priv Escalation

权限声明未反映实际filesystem操作

clawhub.json声明permissions: ['network:outbound']，但install_gene会将第三方Gene代码写入~/.rotifer/目录，这是filesystem:WRITE级别的操作。

clawhub.json:15
权限声明应包含filesystem:WRITE和对应的工具限制说明
Medium RCE

agent_run可执行任意安装的第三方代码

create_agent和agent_run允许创建并执行本地Agent，这些Agent由Gene组成，来自第三方 marketplace。虽然声称运行在WASM沙箱中，但SKILL.md未提供沙箱限制的技术细节。

SKILL.md:53
明确文档化沙箱边界和可执行代码类型的限制
Medium Data Exfil

登录用户的使用遥测数据外传

当用户登录Rotifer账号时，MCP服务器会向Rotifer Cloud发送工具调用记录(工具名、Gene ID、执行结果、延迟、用户ID)。虽声称不含文件内容或环境变量，但仍有隐私风险。

SKILL.md:76
提供更明确的数据类型清单，允许用户完全禁用遥测
Low Doc Mismatch

文档声称工具限制但未提供技术验证机制

SKILL.md声称--tools=evolve限制了10个工具，拒绝其他21个工具。但这是MCP服务器运行时行为，用户无法在执行前验证。

SKILL.md:21
提供可独立验证的工具白名单或MCP协议审计日志

Declared capability vs actual capability

Network Block
Declared READ
→
Inferred WRITE
SKILL.md:19 npx @rotifer/[email protected]执行远程包
Filesystem Block
Declared NONE
→
Inferred WRITE
SKILL.md:32 install_gene写入~/.rotifer/
code_execution Block
Declared NONE
→
Inferred WRITE
SKILL.md:53 agent_run执行Agent的Genes
Shell Block
Declared NONE
→
Inferred WRITE
SKILL.md:18 npx命令执行

Suspicious artifacts and egress

Medium External URL
https://rotifer.dev

CONTRIBUTING.md:6

Medium External URL
https://www.conventionalcommits.org/

CONTRIBUTING.md:20

Medium External URL
https://developercertificate.org/

CONTRIBUTING.md:40

Medium External URL
http://www.apache.org/licenses/

LICENSE:3

Medium External URL
http://www.apache.org/licenses/LICENSE-2.0

LICENSE:184

Medium External URL
https://www.npmjs.com/package/@rotifer/mcp-server/v/0.15.0

README.md:140

Medium External URL
https://rotifer.ai

README.md:185

Medium External URL
https://rotifer.dev/docs

README.md:186

Info Email
[email protected]

CONTRIBUTING.md:53

Info Email
[email protected]

CONTRIBUTING.md:90

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
@rotifer/mcp-server 0.15.0 npm No 通过npx动态拉取，存在供应链风险；建议本地安装并校验hash
@rotifer/playground * npm No fallback依赖，当rotifer CLI不在PATH时通过npx拉取

File composition

5 files · 685 lines
Markdown 3 files · 464 linesOther 1 files · 190 linesJSON 1 files · 31 lines
Files of concern · 5
LICENSE Other · 190 lines
http://www.apache.org/licenses/ · http://www.apache.org/licenses/LICENSE-2.0
README.md Markdown · 187 lines
https://www.npmjs.com/package/@rotifer/mcp-server/v/0.15.0 · https://rotifer.ai · https://rotifer.dev/docs
SKILL.md Markdown · 187 lines
通过npx动态执行远程npm包 · agent_run可执行任意安装的第三方代码 · 登录用户的使用遥测数据外传 · 文档声称工具限制但未提供技术验证机制
CONTRIBUTING.md Markdown · 90 lines
https://rotifer.dev · https://www.conventionalcommits.org/ · https://developercertificate.org/ · [email protected] · [email protected]
clawhub.json JSON · 31 lines
权限声明未反映实际filesystem操作

Security positives

工具集限制在10个MCP工具，减少攻击面
Gene安装需用户确认(用户确认机制)
提供rollback_gene和snapshot恢复机制
代码开源可审查(github.com/rotifer-protocol/rotifer-mcp-server)
npm包版本固定(0.15.0)防止依赖漂移
未登录用户不发送遥测数据
沙箱执行有WASM层保护(虽未充分说明)
使用Supabase RLS保护公共数据访问