安全决策报告
self-evolution-engine
The skill contains a hardcoded billing API key, undeclared external network calls to skillpay.me, and filesystem WRITE operations to arbitrary skill directories—all not mentioned in SKILL.md—with significant doc-to-code mismatch.
最直接的威胁证据
01
SKILL.md presents skill as a 'monitoring and self-improvement tool' without mentioning billing or network access 初始入口 · SKILL.md
02
payment.py reads SKILLPAY_USER_ID from environment and charges user via external API on every invocation 权限提升 · payment.py
03
Hardcoded billing API key (sk_f03aa8f8...) is exposed in source, enabling key theft if repo is public 权限提升 · payment.py
为什么得出这个结论
3/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 5 步攻击链，另有 3 项高危或严重发现。
复核
依赖与供应链卫生
发现 5 项需要关注的依赖或供应链线索。
攻击链
01
SKILL.md presents skill as a 'monitoring and self-improvement tool' without mentioning billing or network access
初始入口 · SKILL.md:1
02
payment.py reads SKILLPAY_USER_ID from environment and charges user via external API on every invocation
权限提升 · payment.py:59
03
Hardcoded billing API key (sk_f03aa8f8...) is exposed in source, enabling key theft if repo is public
权限提升 · payment.py:12
04
evolution_generator.py writes files and patches to arbitrary skill directories under /root/.openclaw/workspace/skills
权限提升 · evolution_generator.py:39
05
Unpinned dependencies could allow a supply chain attack to inject malicious code during pip install
最终危害 · requirements.txt:1
风险分是怎么被拉高的
Hardcoded billing API key +20
payment.py:12 contains sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2 — credential exposed in source code
Undeclared network access +15
payment.py makes requests to https://skillpay.me without any mention in SKILL.md or capability declarations
Filesystem WRITE to arbitrary paths +10
evolution_generator.py and version_manager.py write to /root/.openclaw/workspace/skills — not declared in SKILL.md
Doc-to-code mismatch +10
SKILL.md omits: billing/payment system, external network calls, file system modifications, version management, evolution generation
最关键的证据
高危 凭证窃取
Hardcoded billing API key in source
A private API key for the SkillPay billing system is hardcoded in plain text at payment.py:12. This key should be stored in environment variables or a secrets manager, not in source code.
payment.py:12 Remove the hardcoded key. Use os.environ.get('BILLING_API_KEY') or a secrets manager. Rotate the exposed key immediately.
高危 文档欺骗
Undeclared external network calls to billing API
The skill makes HTTP requests to https://skillpay.me (payment processing) on every invocation via require_payment(). SKILL.md makes no mention of network access or billing behavior.
payment.py:59 Declare network:READ permission in SKILL.md if billing is intentional, or remove payment.py from the deployed skill package.
高危 文档欺骗
Filesystem WRITE operations not declared in SKILL.md
evolution_generator.py and version_manager.py perform filesystem WRITE operations including creating directories, copying files, and creating version snapshots in /root/.openclaw/workspace/skills. SKILL.md only mentions 'performance monitoring' and 'execution log tracking'.
evolution_generator.py:39 Declare filesystem:WRITE capability in SKILL.md if version management and evolution features are intentional.
中危 供应链
All dependencies use unpinned versions
requirements.txt uses >= version constraints for all packages (python-dateutil>=2.8.0, pandas>=2.0.0, numpy>=1.24.0, psutil>=5.9.0, matplotlib>=3.7.0). This allows supply chain attacks via malicious updated packages.
requirements.txt:1 Pin all dependencies to specific versions (e.g., python-dateutil==2.8.2) to prevent supply chain attacks.
中危 文档欺骗
SKILL.md lacks critical feature disclosures
SKILL.md lists only 5 tools and describes monitoring/analyzing capabilities, but omits: (1) the SkillPay billing integration, (2) external API calls, (3) evolution/patch generation, (4) version snapshots and rollback, (5) file modification in target skill directories.
SKILL.md:1 Update SKILL.md to explicitly list all capabilities: network access, filesystem WRITE, version management, and billing integration.
低危 敏感访问
Hardcoded workspace path references /root
Both evolution_generator.py and version_manager.py hardcode workspace_dir = '/root/.openclaw/workspace/skills'. This is Linux-specific and references a privileged path.
evolution_generator.py:22 Use a configurable workspace path via environment variable or CLI argument instead of hardcoding /root paths.
声明能力 vs 实际能力
文件系统 阻止
声明 READ (JSON log reading only)
→ 推断 WRITE
evolution_generator.py:39 (mkdir), version_manager.py:43 (shutil.copy2), version_manager.py:87 (create_snapshot) 网络访问 阻止
声明 NONE
→ 推断 READ (external billing API)
payment.py:26,32,52 (requests.get/post to https://skillpay.me) 命令执行 通过
声明 NONE
→ 推断 NONE
No subprocess/os.system calls found 环境变量 阻止
声明 NONE
→ 推断 READ (SKILLPAY_USER_ID)
payment.py:59 (os.environ.get('SKILLPAY_USER_ID')) 可疑产物与外联
高危 API 密钥
API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2" payment.py:12
中危 外部 URL
https://skillpay.me payment.py:11
中危 外部 URL
https://clawhub.ai/user/shenmeng skill-card.md:7
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| python-dateutil | >=2.8.0 | pip | 否 | Version not pinned — could install malicious latest version |
| pandas | >=2.0.0 | pip | 否 | Version not pinned |
| numpy | >=1.24.0 | pip | 否 | Version not pinned |
| psutil | >=5.9.0 | pip | 否 | Version not pinned |
| matplotlib | >=3.7.0 | pip | 否 | Version not pinned |
文件构成
10 个文件 · 1691 行
Python 5 个文件 · 1300 行Markdown 3 个文件 · 372 行Text 1 个文件 · 14 行JSON 1 个文件 · 5 行
需关注文件 · 4
payment.py Hardcoded billing API key in source · Undeclared external network calls to billing API · API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2" · https://skillpay.me
SKILL.md SKILL.md lacks critical feature disclosures
skill-card.md https://clawhub.ai/user/shenmeng
requirements.txt All dependencies use unpinned versions
其他文件 · evolution_generator.py · version_manager.py · error_analyzer.py · performance_monitor.py · architecture.md · _meta.json
安全亮点
No obfuscation detected (no base64, no eval, no encoded payloads)
No reverse shell or C2 communication patterns found
No credential exfiltration beyond the billing API key itself
Evolution application requires explicit --confirm flag (safety mechanism present)
skill-card.md honestly discloses known risks including the billing behavior and embedded key
No access to ~/.ssh, ~/.aws, or other sensitive credential paths
No curl|bash or wget|sh remote script execution patterns