Skill Trust Decision
bothire
纯文档型技能，仅指向外部动态协议规范，存在可变性风险但无直接恶意代码
Why this conclusion was reached
0/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
11 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
What drove the risk score up
外部动态规范 +15
完整协议从 https://www.bothire.io/skill.md 运行时获取，协议可任意变更
npx执行未锁定版本 +10
文档中提到 npx bothire 但无版本锁定，存在供应链风险
无本地代码审查可能 +10
技能仅含文档，真实能力取决于外部协议，无法预审查
Most important evidence
Medium Supply Chain
依赖外部动态协议规范
技能自身无代码，完整协议规范从 https://www.bothire.io/skill.md 运行时获取。这意味着协议可以在任何时候变更，包括恶意的API端点或支付地址。
SKILL.md:59 在执行前缓存并验证外部规范内容，设置规范版本锁定机制
Medium Supply Chain
未固定的npx包执行
文档建议执行 npx bothire 生成钱包和注册身份，但未指定版本号或包来源校验
SKILL.md:51 使用锁定版本或验证包完整性后再执行
Low Doc Mismatch
声明-能力映射不清晰
文档描述了支付、钱包、合约交互等金融能力，但无代码实现可审查
SKILL.md:1 提供本地参考实现或沙箱环境供安全审计
Declared capability vs actual capability
Filesystem Pass
Declared NONE
→ Inferred NONE
无脚本文件 Network Pass
Declared NONE
→ Inferred READ
SKILL.md:43 引用外部API端点，实际执行需网络访问 Shell Pass
Declared NONE
→ Inferred NONE
文档提及 npx bothire 但无本地脚本执行 credential Pass
Declared NONE
→ Inferred NONE
文档描述加密货币钱包集成但无代码 Suspicious artifacts and egress
Medium External URL
https://www.bothire.io SKILL.md:8
Medium External URL
https://www.bothire.io/skill.md SKILL.md:34
Medium External URL
https://www.bothire.io/api/skills/search?keyword=video SKILL.md:43
Medium External URL
https://www.bothire.io/api/bots/search?keyword=research SKILL.md:44
Medium External URL
https://www.bothire.io/api/skills/categories SKILL.md:45
Medium External URL
https://www.bothire.io/explore SKILL.md:46
Medium External URL
https://www.bothire.io/skill.md. SKILL.md:59
Medium External URL
https://www.bothire.io/skill.md** SKILL.md:86
Medium External URL
https://clawhub.ai/user/bothireagent skill-card.md:9
Medium External URL
https://clawhub.ai/bothireagent/skills/bothire skill-card.md:42
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| bothire (npm package) | unpinned | npx | No | 通过 npx 执行无版本锁定 |
| bothtie.io/skill.md | live/dynamic | HTTP | No | 运行时获取的外部协议规范，无法预审计 |
File composition
2 files · 149 lines
Markdown 2 files · 149 lines
Files of concern · 2
SKILL.md 依赖外部动态协议规范 · 未固定的npx包执行 · 声明-能力映射不清晰 · https://www.bothire.io · https://www.bothire.io/skill.md · https://www.bothire.io/api/skills/search?keyword=video · https://www.bothire.io/api/bots/search?keyword=research · https://www.bothire.io/api/skills/categories · https://www.bothire.io/explore · https://www.bothire.io/skill.md. · https://www.bothire.io/skill.md** · [email protected]
skill-card.md https://clawhub.ai/user/bothireagent · https://clawhub.ai/bothireagent/skills/bothire
Security positives
无本地恶意代码
无凭证收割逻辑
无数据外泄行为
skill-card.md 主动标注了已知风险并提供缓解建议
使用 MIT-0 许可证