Skill Trust Decision
pancreatic-lipase-pro-docking
该技能声称是分子对接工具，但通过base64编码的zip隐藏核心代码（300KB+），包含7个加密货币钱包地址，且SKILL.md未声明提取行为，透明度严重不足。
Most direct threat evidence
01
用户通过SKILL.md描述（分子对接工具）建立初始信任 Entry · SKILL.md
02
restore_and_run.sh静默解码base64 zip并extractall()，隐藏真实代码量 Escalation · restore_and_run.sh
03
7个加密货币钱包地址嵌入payload，意图不明——可能是支付地址或标识符 Impact · payload_universal_upload.txt
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
3 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
7 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
用户通过SKILL.md描述（分子对接工具）建立初始信任
Entry · SKILL.md:1
02
restore_and_run.sh静默解码base64 zip并extractall()，隐藏真实代码量
Escalation · restore_and_run.sh:28
03
7个加密货币钱包地址嵌入payload，意图不明——可能是支付地址或标识符
Impact · payload_universal_upload.txt:223,1138,1960,2625,3005,3579,3656
04
extractall('.')若zip含路径遍历文件名可覆盖系统文件
Impact · restore_and_run.sh:31
What drove the risk score up
核心代码被base64编码隐藏 +20
300KB+ payload以base64 zip形式存在，restore_and_run.sh解码后extractall()，无法静态审查
7个加密货币钱包地址嵌入payload +15
payload_universal_upload.txt lines 223,1138,1960,2625,3005,3579,3656 包含BTC/XMR地址
SKILL.md未声明提取行为 +12
restore_and_run.sh执行base64解码+zip解压，但SKILL.md只字未提此过程
无allowedTools声明 +5
SKILL.md frontmatter无allowedTools字段，无法确认声明权限
Most important evidence
High Obfuscation
核心代码以base64编码zip形式隐藏
restore_and_run.sh从payload_universal_upload.txt中提取base64编码的zip，解码后extractall()，但SKILL.md未声明此提取行为。主要代码arena_auto_run.py等约20个文件全部压缩在zip中无法静态审查。
restore_and_run.sh:21 要求作者提供所有源码的明文版本，或在可信沙箱中提取并逐文件审查。
High Supply Chain
7个加密货币钱包地址嵌入payload二进制数据
预扫描在payload_universal_upload.txt中发现7个crypto wallet地址（1RZnYTW3xR5kr..., 3hyL36N13XxA7Xb..., 3YuydcZ9UZT99C..., 3qVyUnTW1KvEB..., 3XbFGrEd8xVip..., 3issF73N6DkXEv..., 3uJhvMKyqpJwh...），这些地址在分子对接程序的二进制payload中无合理解释。
payload_universal_upload.txt:223,1138,1960,2625,3005,3579,3656 要求作者解释这些地址的来源和用途。分子对接程序不应包含加密货币地址。
Medium Doc Mismatch
SKILL.md未声明restore_and_run.sh的提取行为
Quick Start仅展示bash命令示例，完全未提及restore_and_run.sh会解码base64 zip并extractall到docking_professional_stack/目录。SKILL.md中'no credentials embedded'的声明无法验证（代码被隐藏）。
SKILL.md:1 SKILL.md应完整披露代码提取、解压机制及所有源码位置。
Medium Supply Chain
zip解压路径验证不足
restore_and_run.sh使用extractall('.')直接解压到当前目录，攻击者可通过目录遍历文件名（如../../）实现路径穿越，或在已存在docking_professional_stack/时跳过hash验证直接运行旧版本。
restore_and_run.sh:31 验证SHA256后再解压到固定路径，使用zipfile.extract()逐文件验证路径安全。
Low Doc Mismatch
版本元数据不一致
_meta.json声明version=100.3.7，SKILL.md frontmatter声明version=100.3.4，payload_universal_upload.txt头注释未标版本号。多版本标识可能造成混淆。
_meta.json, SKILL.md:1 统一版本号标识。
Declared capability vs actual capability
Filesystem Block
Declared NONE
→ Inferred WRITE
restore_and_run.sh:31 extractall() Shell Block
Declared NONE
→ Inferred WRITE
restore_and_run.sh:65 exec python3 Environment Block
Declared NONE
→ Inferred READ
restore_and_run.sh:59 reads argv Suspicious artifacts and egress
Medium Wallet Address
1RZnYTW3xR5kr3Ty1EfJRyMtwLT7a payload_universal_upload.txt:223
Medium Wallet Address
3hyL36N13XxA7XbuUv7E4XAE58HfEuw payload_universal_upload.txt:1138
Medium Wallet Address
3YuydcZ9UZT99CRpckhsT93s16TS9Lo payload_universal_upload.txt:1960
Medium Wallet Address
3qVyUnTW1KvEBszGLVrPMBZkqHpKB payload_universal_upload.txt:2625
Medium Wallet Address
3XbFGrEd8xVip41MeJw2umRXt7YwRuqm payload_universal_upload.txt:3005
Medium Wallet Address
3issF73N6DkXEvj9neYsPm2Uet1 payload_universal_upload.txt:3579
Medium Wallet Address
3uJhvMKyqpJwh7kcs5W27sRM4Bwd payload_universal_upload.txt:3656
Dependencies and supply chain
There are no structured dependency warnings.
File composition
5 files · 4362 lines
Text 1 files · 4130 linesMarkdown 2 files · 160 linesShell 1 files · 67 linesJSON 1 files · 5 lines
Files of concern · 3
payload_universal_upload.txt 7个加密货币钱包地址嵌入payload二进制数据 · 1RZnYTW3xR5kr3Ty1EfJRyMtwLT7a · 3hyL36N13XxA7XbuUv7E4XAE58HfEuw · 3YuydcZ9UZT99CRpckhsT93s16TS9Lo · 3qVyUnTW1KvEBszGLVrPMBZkqHpKB · 3XbFGrEd8xVip41MeJw2umRXt7YwRuqm · 3issF73N6DkXEvj9neYsPm2Uet1 · 3uJhvMKyqpJwh7kcs5W27sRM4Bwd
SKILL.md SKILL.md未声明restore_and_run.sh的提取行为
restore_and_run.sh 核心代码以base64编码zip形式隐藏 · zip解压路径验证不足
Other files · README.md · _meta.json
Security positives
SKILL.md包含详细的功能文档和测试说明
restore_and_run.sh在提取前检查目标目录是否存在，避免重复提取
作者声称'fail-closed'设计理念（虽无法验证代码）
payload头注释包含SHA256预期值