安全决策报告

cloud-compare

SKILL.md声明依赖需手动安装,但代码包含自动安装功能和反自动化检测绕过(stealth模式),存在文档-行为不一致。pip依赖无版本锁定存在供应链风险。

安装决策优先 来源: ClawHub 扫描时间: 2026/6/14
文件 5
IOC 207
越权项 2
发现 4
最直接的威胁证据

为什么得出这个结论

2/4 个维度触发
阻止
声明与实际能力

发现 2 项声明之外的能力或越权行为。

阻止
隐藏执行与外联

提取到 1 个高危 IOC 或外联信号。

通过
攻击链与高危发现

没有形成明确的恶意路径。

复核
依赖与供应链卫生

发现 3 项需要关注的依赖或供应链线索。

风险分是怎么被拉高的

文档-行为不一致 +20

SKILL.md声明依赖需手动安装,但代码实现自动安装(_ensure_dep/_ensure_playwright)

subprocess调用未声明 +15

代码执行subprocess.run进行pip install和playwright install,未在SKILL.md声明

stealth模式反自动化检测 +10

--disable-blink-features=AutomationControlled绕过爬虫检测,用户不知情

依赖无版本锁定 +5

pip install playwright httpx beautifulsoup4 无版本限制

最关键的证据

中危 文档欺骗

文档声明与代码行为不符

SKILL.md声明'依赖需手动安装:pip install playwright httpx beautifulsoup4',但代码包含_ensure_dep()和_ensure_playwright()函数,会自动执行pip install和playwright install chromium。文档应明确说明是否支持自动安装。

scripts/cloud_doc_scraper.py:36
在SKILL.md明确声明subprocess能力,或移除自动安装函数改为纯提示
中危 代码混淆

Stealth模式绕过反自动化检测

--stealth参数实现反爬虫功能,使用--disable-blink-features=AutomationControlled和Object.defineProperty(navigator, 'webdriver')绕过网站检测,但SKILL.md仅描述为'处理JS渲染兼容性问题',未说明真实用途。

scripts/cloud_doc_scraper.py:799
在SKILL.md明确说明stealth模式的反爬虫绕过功能及其风险
中危 供应链

pip依赖无版本锁定

安装命令'pip install playwright httpx beautifulsoup4'无版本锁定,可能引入恶意或漏洞版本。

SKILL.md:29
使用版本锁定:playwright>=1.40.0 httpx>=0.25.0 beautifulsoup4>=4.12.0
低危 敏感访问

硬编码IP地址(内网)

line 803存在硬编码IP 131.0.0.0,经分析为内网保留地址(131.0.0.0/8),非恶意IP但需确认用途。

scripts/cloud_doc_scraper.py:803
确认该IP用途,若非必要应移除或改为配置化

声明能力 vs 实际能力

网络访问 通过
声明 READ
推断 READ
web_fetch读取文档URL
命令执行 阻止
声明 NONE
推断 WRITE
scripts/cloud_doc_scraper.py:36-47 _ensure_dep/_ensure_playwright执行subprocess
文件系统 阻止
声明 NONE
推断 WRITE
scripts/cloud_doc_scraper.py:792 Path(output).write_text写入markdown

可疑产物与外联

高危 IP 地址
131.0.0.0

scripts/cloud_doc_scraper.py:803

中危 外部 URL
https://support.huaweicloud.cn/wtsnew-

SKILL.md:77

中危 外部 URL
https://help.aliyun.com/zh/

SKILL.md:80

中危 外部 URL
https://docs.aws.amazon.com/zh_cn/

SKILL.md:85

中危 外部 URL
https://help.aliyun.com/zh/ecs

SKILL.md:92

中危 外部 URL
https://help.aliyun.com/zh/ecs/product-overview/release-notes

SKILL.md:92

中危 外部 URL
https://help.aliyun.com/zh/fc

SKILL.md:93

中危 外部 URL
https://help.aliyun.com/zh/fc/product-overview/release-notes

SKILL.md:93

中危 外部 URL
https://help.aliyun.com/zh/oss

SKILL.md:94

中危 外部 URL
https://help.aliyun.com/zh/oss/product-overview/release-notes

SKILL.md:94

中危 外部 URL
https://help.aliyun.com/zh/nas

SKILL.md:95

中危 外部 URL
https://help.aliyun.com/zh/nas/product-overview/release-notes

SKILL.md:95

依赖与供应链

包名版本来源漏洞备注
playwright * pip 无版本锁定
httpx * pip 无版本锁定
beautifulsoup4 * pip 无版本锁定

文件构成

5 个文件 · 1320 行
Python 1 个文件 · 863 行Markdown 1 个文件 · 248 行Shell 2 个文件 · 204 行JSON 1 个文件 · 5 行
需关注文件 · 2
scripts/cloud_doc_scraper.py Python · 863 行
文档声明与代码行为不符 · Stealth模式绕过反自动化检测 · 硬编码IP地址(内网) · 131.0.0.0 · https://support.huaweicloud.com/productdesc-ecs/zh-cn_topic_0013771112.html · https://support.huaweicloud.com/productdesc-ecs/ecs_01_0002.html · https://support.huaweicloud.com/productdesc-ecs/ecs_01_0003.html · https://support.huaweicloud.com/productdesc-ecs/ecs_01_0014.html · https://support.huaweicloud.com/productdesc-ecs/ecs_01_0005.html · https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/document-history-release-notes.html · https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/concepts.html · https://docs.aws.amazon.com/zh_cn/ec2/latest/instancetypes/instance-types.html · https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/instance-purchasing-options.html · https://aws.amazon.com/cn/ec2/features/ · https://support.huaweicloud.com/productdesc-obs/zh-cn_topic_0045829060.html · https://support.huaweicloud.com/productdesc-obs/obs_03_0201.html · https://support.huaweicloud.com/productdesc-obs/obs_03_0202.html · https://support.huaweicloud.com/productdesc-obs/obs_03_0151.html · https://support.huaweicloud.com/productdesc-obs/obs_03_0360.html · https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/userguide/Welcome.html · https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/userguide/WhatsNew.html · https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/userguide/storage-class-intro.html · https://aws.amazon.com/cn/s3/features/ · https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/userguide/optimizing-performance.html · https://support.huaweicloud.com/productdesc-rds/zh-cn_topic_dashboard.html · https://support.huaweicloud.com/price-rds/rds_00_0006.html · https://support.huaweicloud.com/qs-rds/rds_02_0148.html · https://support.huaweicloud.com/pwp-rds/pwp_0000.html · https://support.huaweicloud.com/bestpractice-rds/practice_0000.html · https://docs.aws.amazon.com/zh_cn/AmazonRDS/latest/UserGuide/Welcome.html · https://docs.aws.amazon.com/zh_cn/AmazonRDS/latest/UserGuide/WelcomeDocHistory.html · https://docs.aws.amazon.com/zh_cn/AmazonRDS/latest/UserGuide/Concepts.DBInstance.html · https://docs.aws.amazon.com/zh_cn/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html · https://aws.amazon.com/cn/rds/features/ · https://support.huaweicloud.com/productdesc-dcs/dcs-pd-200713001.html · https://support.huaweicloud.com/productdesc-dcs/dcs-pd-200713002.html · https://support.huaweicloud.com/productdesc-dcs/dcs_01_0006.html · https://support.huaweicloud.com/productdesc-dcs/dcs_01_0002.html · https://support.huaweicloud.com/productdesc-dcs/dcs-pd-191224001.html · https://docs.aws.amazon.com/zh_cn/AmazonElastiCache/latest/red-ug/WhatIs.html · https://docs.aws.amazon.com/zh_cn/AmazonElastiCache/latest/red-ug/WhatsNew.html · https://docs.aws.amazon.com/zh_cn/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html · https://aws.amazon.com/cn/elasticache/features/ · https://support.huaweicloud.com/productdesc-cce/cce_productdesc_0001.html · https://support.huaweicloud.com/productdesc-cce/cce_productdesc_0002.html · https://support.huaweicloud.com/productdesc-cce/cce_productdesc_0003.html · https://support.huaweicloud.com/productdesc-cce/cce_productdesc_0005.html · https://docs.aws.amazon.com/zh_cn/eks/latest/userguide/what-is-eks.html · https://docs.aws.amazon.com/zh_cn/eks/latest/userguide/doc-history.html · https://aws.amazon.com/cn/eks/features/ · https://docs.aws.amazon.com/zh_cn/eks/latest/userguide/kubernetes-versions.html · https://support.huaweicloud.com/productdesc-functiongraph/functiongraph_01_0100.html · https://support.huaweicloud.com/productdesc-functiongraph/functiongraph_01_0200.html · https://support.huaweicloud.com/productdesc-functiongraph/functiongraph_01_0300.html · https://docs.aws.amazon.com/zh_cn/lambda/latest/dg/welcome.html · https://docs.aws.amazon.com/zh_cn/lambda/latest/dg/lambda-releases.html · https://aws.amazon.com/cn/lambda/features/ · https://docs.aws.amazon.com/zh_cn/lambda/latest/dg/lambda-runtimes.html · https://docs.aws.amazon.com/zh_cn/lambda/latest/dg/gettingstarted-limits.html · https://support.huaweicloud.com/productdesc-elb/elb_pro_0001.html · https://support.huaweicloud.com/productdesc-elb/elb_pro_0003.html · https://support.huaweicloud.com/productdesc-elb/elb_pro_0004.html · https://support.huaweicloud.com/productdesc-elb/elb_pro_0010.html · https://docs.aws.amazon.com/zh_cn/elasticloadbalancing/latest/userguide/what-is-load-balancing.html · https://docs.aws.amazon.com/zh_cn/elasticloadbalancing/latest/userguide/document-history.html · https://aws.amazon.com/cn/elasticloadbalancing/features/ · https://support.huaweicloud.com/productdesc-mrs/mrs_08_0001.html · https://support.huaweicloud.com/productdesc-mrs/mrs_08_0005.html · https://support.huaweicloud.com/productdesc-mrs/mrs_08_0002.html · https://docs.aws.amazon.com/zh_cn/emr/latest/ManagementGuide/emr-what-is-emr.html · https://docs.aws.amazon.com/zh_cn/emr/latest/ReleaseGuide/emr-release-components.html · https://aws.amazon.com/cn/emr/features/ · https://support.huaweicloud.com/productdesc-modelarts/modelarts_product_0001.html · https://support.huaweicloud.com/productdesc-modelarts/modelarts_product_0002.html · https://support.huaweicloud.com/productdesc-modelarts/modelarts_product_0003.html · https://docs.aws.amazon.com/zh_cn/sagemaker/latest/dg/whatis.html · https://docs.aws.amazon.com/zh_cn/sagemaker/latest/dg/doc-history.html · https://aws.amazon.com/cn/sagemaker/features/ · https://docs.aws.amazon.com/zh_cn/sagemaker/latest/dg/instance-types.html · https://docs.aws.amazon.com/zh_cn/bedrock/latest/userguide/what-is-bedrock.html · https://docs.aws.amazon.com/zh_cn/bedrock/latest/userguide/doc-history.html · https://docs.aws.amazon.com/zh_cn/bedrock/latest/userguide/models-supported.html · https://aws.amazon.com/cn/bedrock/features/ · https://support.huaweicloud.com/productdesc-cdn/zh-cn_topic_0064907747.html · https://support.huaweicloud.com/productdesc-cdn/zh-cn_topic_0064907763.html · https://support.huaweicloud.com/productdesc-cdn/cdn_01_0067.html · https://support.huaweicloud.com/productdesc-cdn/cdn_01_0369.html · https://support.huaweicloud.com/productdesc-cdn/cdn_01_0068.html · https://docs.aws.amazon.com/zh_cn/AmazonCloudFront/latest/DeveloperGuide/Introduction.html · https://docs.aws.amazon.com/zh_cn/AmazonCloudFront/latest/DeveloperGuide/document-history.html · https://aws.amazon.com/cn/cloudfront/features/ · https://docs.aws.amazon.com/zh_cn/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehavior.html · https://support.huaweicloud.com/productdesc-sfs/zh-cn_topic_0034428718.html · https://support.huaweicloud.com/productdesc-sfs/sfs_01_0004.html · https://support.huaweicloud.com/productdesc-sfs/sfs_01_0110.html · https://support.huaweicloud.com/productdesc-sfs/sfs_01_0011.html · https://support.huaweicloud.com/productdesc-sfs/sfs_01_0108.html · https://docs.aws.amazon.com/zh_cn/efs/latest/ug/whatisefs.html · https://docs.aws.amazon.com/zh_cn/efs/latest/ug/efs-release-notes.html · https://aws.amazon.com/cn/efs/features/ · https://docs.aws.amazon.com/zh_cn/efs/latest/ug/performance.html · https://support.huaweicloud.com/productdesc-dli/dli_01_0001.html · https://support.huaweicloud.com/productdesc-dli/dli_01_0002.html · https://support.huaweicloud.com/productdesc-dli/dli_01_0003.html · https://docs.aws.amazon.com/zh_cn/managed-flink/latest/java/what-is.html · https://docs.aws.amazon.com/zh_cn/managed-flink/latest/java/release-notes.html · https://aws.amazon.com/cn/managed-service-apache-flink/features/ · https://support.huaweicloud.com/productdesc-css/css_04_0001.html · https://support.huaweicloud.com/productdesc-css/css_04_0010.html · https://support.huaweicloud.com/productdesc-css/css_04_0002.html · https://support.huaweicloud.com/productdesc-css/css_04_0003.html · https://support.huaweicloud.com/productdesc-css/css_04_0005.html · https://docs.aws.amazon.com/zh_cn/opensearch-service/latest/developerguide/what-is.html · https://docs.aws.amazon.com/zh_cn/opensearch-service/latest/developerguide/release-notes.html · https://aws.amazon.com/cn/opensearch-service/features/ · https://docs.aws.amazon.com/zh_cn/opensearch-service/latest/developerguide/what-is.html#choosing-version · https://help.aliyun.com/zh/analyticdb-for-postgresql/product-overview/what-is-analyticdb-for-postgresql · https://help.aliyun.com/zh/analyticdb-for-postgresql/product-overview/features · https://help.aliyun.com/zh/analyticdb-for-postgresql/product-overview/benefits · https://help.aliyun.com/zh/analyticdb-for-postgresql/product-overview/editions · https://help.aliyun.com/zh/analyticdb-for-postgresql/product-overview/scenarios · https://help.aliyun.com/zh/analyticdb-for-postgresql/product-overview/limits-and-restrictions · https://support.huaweicloud.com/productdesc-dws/dws_01_0002.html · https://support.huaweicloud.com/productdesc-dws/dws_01_00017.html · https://support.huaweicloud.com/productdesc-dws/dws_01_0004.html · https://support.huaweicloud.com/productdesc-dws/dws_01_0006.html · https://support.huaweicloud.com/productdesc-dws/dws_01_0007.html · https://docs.aws.amazon.com/zh_cn/redshift/latest/mgmt/welcome.html · https://docs.aws.amazon.com/zh_cn/redshift/latest/mgmt/doc-history.html · https://aws.amazon.com/cn/redshift/features/ · https://docs.aws.amazon.com/zh_cn/redshift/latest/mgmt/working-with-clusters.html#rs-node-types · https://docs.aws.amazon.com/zh_cn/redshift/latest/mgmt/serverless-whatis.html
SKILL.md Markdown · 248 行
pip依赖无版本锁定 · https://support.huaweicloud.cn/wtsnew- · https://help.aliyun.com/zh/ · https://docs.aws.amazon.com/zh_cn/ · https://help.aliyun.com/zh/ecs · https://help.aliyun.com/zh/ecs/product-overview/release-notes · https://help.aliyun.com/zh/fc · https://help.aliyun.com/zh/fc/product-overview/release-notes · https://help.aliyun.com/zh/oss · https://help.aliyun.com/zh/oss/product-overview/release-notes · https://help.aliyun.com/zh/nas · https://help.aliyun.com/zh/nas/product-overview/release-notes · https://help.aliyun.com/zh/rds · https://help.aliyun.com/zh/rds/product-overview/release-notes · https://help.aliyun.com/zh/redis · https://help.aliyun.com/zh/redis/product-overview/release-notes · https://help.aliyun.com/zh/analyticdb-for-postgresql · https://help.aliyun.com/zh/analyticdb-for-postgresql/product-overview/release-notes · https://help.aliyun.com/zh/ack · https://help.aliyun.com/zh/ack/product-overview/release-notes · https://help.aliyun.com/zh/slb · https://help.aliyun.com/zh/slb/product-overview/release-notes · https://help.aliyun.com/zh/cdn · https://help.aliyun.com/zh/cdn/product-overview/release-notes · https://help.aliyun.com/zh/maxcompute · https://help.aliyun.com/zh/maxcompute/product-overview/Release-notes · https://help.aliyun.com/zh/flink · https://help.aliyun.com/zh/flink/product-overview/release-note · https://help.aliyun.com/zh/elasticsearch · https://help.aliyun.com/zh/elasticsearch/product-overview/release-notes · https://help.aliyun.com/zh/pai · https://help.aliyun.com/zh/pai/user-guide/api-aiworkspace-2021-02-04-changeset · https://help.aliyun.com/zh/bailian · https://help.aliyun.com/zh/bailian/release-notes · https://support.huaweicloud.cn/ecs/index.html · https://support.huaweicloud.cn/wtsnew-ecs/index.html · https://support.huaweicloud.cn/functiongraph/index.html · https://support.huaweicloud.cn/wtsnew-functiongraph/index.html · https://support.huaweicloud.cn/obs/index.html · https://support.huaweicloud.cn/wtsnew-obs/index.html · https://support.huaweicloud.cn/sfs/index.html · https://support.huaweicloud.cn/wtsnew-sfs/index.html · https://support.huaweicloud.cn/rds/index.html · https://support.huaweicloud.cn/wtsnew-rds/index.html · https://support.huaweicloud.cn/dcs/index.html · https://support.huaweicloud.cn/wtsnew-dcs/index.html · https://support.huaweicloud.cn/dws/index.html · https://support.huaweicloud.cn/wtsnew-dws/index.html · https://support.huaweicloud.cn/cce/index.html · https://support.huaweicloud.cn/wtsnew-cce/index.html · https://support.huaweicloud.cn/elb/index.html · https://support.huaweicloud.cn/wtsnew-elb/index.html · https://support.huaweicloud.cn/cdn/index.html · https://support.huaweicloud.cn/wtsnew-cdn/index.html · https://support.huaweicloud.cn/mrs/index.html · https://support.huaweicloud.cn/wtsnew-mrs/index.html · https://support.huaweicloud.cn/dli/index.html · https://support.huaweicloud.cn/wtsnew-dli/index.html · https://support.huaweicloud.cn/css/index.html · https://support.huaweicloud.cn/wtsnew-css/index.html · https://support.huaweicloud.cn/modelarts/index.html · https://support.huaweicloud.cn/wtsnew-modelarts/index.html · https://support.huaweicloud.cn/pangu/index.html · https://support.huaweicloud.cn/wtsnew-pangu/index.html · https://docs.aws.amazon.com/zh_cn/ec2/ · https://docs.aws.amazon.com/zh_cn/lambda/ · https://docs.aws.amazon.com/zh_cn/AmazonS3/ · https://docs.aws.amazon.com/zh_cn/efs/ · https://docs.aws.amazon.com/zh_cn/AmazonRDS/ · https://docs.aws.amazon.com/zh_cn/AmazonElastiCache/ · https://docs.aws.amazon.com/zh_cn/redshift/ · https://docs.aws.amazon.com/zh_cn/eks/ · https://docs.aws.amazon.com/zh_cn/elasticloadbalancing/ · https://docs.aws.amazon.com/zh_cn/AmazonCloudFront/ · https://docs.aws.amazon.com/zh_cn/emr/ · https://docs.aws.amazon.com/zh_cn/managed-flink/ · https://docs.aws.amazon.com/zh_cn/opensearch-service/ · https://docs.aws.amazon.com/zh_cn/sagemaker/ · https://docs.aws.amazon.com/zh_cn/bedrock/
其他文件 · test.sh · test.sh · _meta.json

安全亮点

代码结构清晰,主要功能是网页抓取文档,无明显恶意代码
有完善的错误处理和重试机制
敏感信息(如凭证)未发现外泄行为
无base64编码、eval、shell管道等危险模式