安全决策报告
agentkind
Skill contains a documented but dangerous curl|sh setup pattern that could be executed by an AI agent, though skill-card.md explicitly warns against it.
最直接的威胁证据
01
AI agent loads SKILL.md documentation 初始入口 · SKILL.md
02
Documentation shows curl|sh as the 'Setup (once)' command persuasion · SKILL.md
03
Agent executes curl -fsSL https://agentkind.io/join.sh | sh, downloading and running remote script 代码执行 · SKILL.md
为什么得出这个结论
2/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 4 步攻击链，另有 1 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
攻击链
01
AI agent loads SKILL.md documentation
初始入口 · SKILL.md:1
02
Documentation shows curl|sh as the 'Setup (once)' command
persuasion · SKILL.md:18
03
Agent executes curl -fsSL https://agentkind.io/join.sh | sh, downloading and running remote script
代码执行 · SKILL.md:18
04
Remote script executes with agent's shell permissions (arbitrary code execution)
最终危害 · https://agentkind.io/join.sh
风险分是怎么被拉高的
Dangerous curl|sh pattern in documentation +25
SKILL.md:18 shows 'curl -fsSL https://agentkind.io/join.sh | sh' which executes arbitrary remote script code
Undeclared shell:WRITE capability +15
Skill shows bash commands but does not declare shell:WRITE in any allowedTools mapping
Mitigated by explicit warning +-10
skill-card.md explicitly warns against curl|sh and recommends API-based registration
No actual malicious code present +-5
Skill is pure documentation; no scripts to execute
最关键的证据
高危 代码执行
Dangerous curl|sh pattern in documentation
SKILL.md shows a curl pipe to shell command for setup. If an AI agent executes this, it will download and run an arbitrary script from agentkind.io with the agent's permissions. This is a classic supply chain attack vector.
SKILL.md:18 Use the API-based registration instead: POST to https://agentkind.io/api/v1/agents/register with a JSON body.
中危 文档欺骗
Undeclared shell execution capability
The skill shows bash commands but does not declare shell:WRITE in any allowedTools mapping, violating transparency requirements.
SKILL.md:18 If shell execution is intended, declare it explicitly with clear documentation of what commands will be run.
低危 凭证窃取
Sensitive credential path access mentioned
Skill references storing API keys in ~/.config/agentkind/credentials.json. While documented, this creates a persistent credential storage location.
SKILL.md:25 Ensure this path is excluded from any git/sync mechanisms. Consider using a more secure credential management approach.
声明能力 vs 实际能力
网络访问 通过
声明 NONE
→ 推断 READ
SKILL.md:21,29 - API calls to agentkind.io 命令执行 通过
声明 NONE
→ 推断 WRITE
SKILL.md:18 - curl|sh command shown but not declared 可疑产物与外联
严重 危险命令
curl -fsSL https://agentkind.io/join.sh | sh SKILL.md:18
中危 外部 URL
https://agentkind.io SKILL.md:4
中危 外部 URL
https://agentkind.io/join.sh SKILL.md:18
中危 外部 URL
https://agentkind.io/api/v1/agents/register SKILL.md:21
中危 外部 URL
https://agentkind.io/api/v1/home SKILL.md:29
中危 外部 URL
https://agentkind.io/skill.md. SKILL.md:39
中危 外部 URL
https://agentkind.io/openapi.json. SKILL.md:39
中危 外部 URL
https://clawhub.ai/user/namanyayg skill-card.md:9
中危 外部 URL
https://agentkind.io/skill.md skill-card.md:43
中危 外部 URL
https://agentkind.io/openapi.json skill-card.md:44
中危 外部 URL
https://clawhub.ai/namanyayg/skills/agentkind skill-card.md:45
依赖与供应链
没有结构化依赖告警。
文件构成
3 个文件 · 108 行
Markdown 2 个文件 · 103 行JSON 1 个文件 · 5 行
需关注文件 · 2
skill-card.md https://clawhub.ai/user/namanyayg · https://agentkind.io/skill.md · https://agentkind.io/openapi.json · https://clawhub.ai/namanyayg/skills/agentkind
SKILL.md Dangerous curl|sh pattern in documentation · Undeclared shell execution capability · Sensitive credential path access mentioned · curl -fsSL https://agentkind.io/join.sh | sh · https://agentkind.io · https://agentkind.io/join.sh · https://agentkind.io/api/v1/agents/register · https://agentkind.io/api/v1/home · https://agentkind.io/skill.md. · https://agentkind.io/openapi.json.
其他文件 · _meta.json
安全亮点
skill-card.md explicitly warns about the curl|sh risk and recommends the safer API-based registration
No actual malicious scripts or code present in the skill
API calls use standard Authorization Bearer token pattern
Skill explicitly states 'Never send your key anywhere but agentkind.io'
Credential storage location is documented, allowing operators to exclude it