中文 EN
Start Review
Skill Trust Decision

universal-service-access

纯文档型凭证管理指导，无可执行代码，文档包含较完整安全规则但缺乏实现细节和验证机制。

Install decision first Source: ClawHub Scanned: Aug 26, 2026
Files 4
Artifacts 0
Violations 0
Findings 3

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Pass
Hidden execution and egress

No obvious high-risk egress or execution signals were found.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

What drove the risk score up

纯文档无代码执行 +-10

无 scripts/ 或可执行文件，风险大幅降低

缺少 allowed-tools 声明 +10

SKILL.md 未声明所需的 allowed-tools，权限边界不明确

文档设计被信任风险 +10

声称是'安全凭证管理器'但无技术实现，可能诱导用户泄露凭证

纯文本无验证机制 +5

'STORE SECURELY' 等指令无实现代码，无法验证是否执行

规则可能被覆盖 +5

大量 'NEVER' 规则易被 prompt injection 覆盖

Most important evidence

Low Doc Mismatch

声称安全但无技术验证

文档声称是'安全凭证管理器'，包含 Never Echo Secret、Secure Storage 等规则，但无实现代码验证规则是否被执行。纯文档型 skill 可能被用户过度信任。

SKILL.md:48
明确说明此仅为 AI 行为指南，不具备技术安全机制
Low Priv Escalation

缺少 allowed-tools 声明

SKILL.md 未声明 AI agent 执行时需要的 allowed-tools。凭证管理暗示需要 filesystem 和 network 权限，但边界不明确。

SKILL.md:1
添加 allowed-tools 声明，如: allowed-tools: [Read, WebFetch]
Info Prompt Injection

规则易被覆盖风险

大量 'NEVER DISPLAY SECRET'、'NEVER COMMIT SECRET TO GIT' 等绝对性规则以纯文本呈现，无技术防护，可能被恶意上下文覆盖。

SKILL.md:63
考虑将关键安全规则在系统层面强制执行，而非依赖 AI 遵循

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred READ
SKILL.md:38 提到 'periksa SECRET STORE / ENVIRONMENT' 暗示需读环境变量，但无明确声明
Network Pass
Declared NONE
→
Inferred WRITE
SKILL.md:48 'Universal Workflow: DISCOVER → AUTHENTICATE → AUTHORIZE → CONNECT → EXECUTE' 暗示需网络写权限
credential_theft Pass
Declared WRITE
→
Inferred WRITE
SKILL.md:11 明确声明 'Kelola kredensial'，但无实现代码验证

Suspicious artifacts and egress

No obvious IOC was extracted.

Dependencies and supply chain

There are no structured dependency warnings.

File composition

4 files · 406 lines
Markdown 2 files · 392 linesOther 1 files · 7 linesJSON 1 files · 7 lines
Files of concern · 1
SKILL.md Markdown · 196 lines
声称安全但无技术验证 · 缺少 allowed-tools 声明 · 规则易被覆盖风险
Other files · README.md · LICENSE · _meta.json

Security positives

文档包含详细的安全原则（Minimum Credential Principle、Never Echo Secret）
有完整的服务检测、连接测试、错误处理指导
包含 prompt injection 防护意识
有 destructive action guard 机制