中文 EN
Start Review
Skill Trust Decision

x402-compute

x402-compute技能功能正常但包含危险操作模式：SKILL.md文档中记录了curl|sh远程脚本执行、依赖无版本锁定、凭证本地写入文件，存在中等供应链风险和文档欺骗风险。

Install decision first Source: ClawHub Scanned: 21 days ago
Files 18
Artifacts 28
Violations 1
Findings 6
Most direct threat evidence
01
用户运行skill部署GPU实例 Entry · SKILL.md
02
provision.py通过x402协议支付USDC Escalation · scripts/provision.py
03
OWS CLI通过subprocess执行外部命令 Escalation · scripts/wallet_signing.py

Why this conclusion was reached

3/4 dimensions flagged
Block
Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Block
Hidden execution and egress

2 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 4 attack-chain steps and 1 severe findings.

Review
Dependencies and supply chain hygiene

5 dependency or supply-chain issues need attention.

Attack Chain

01
用户运行skill部署GPU实例

Entry · SKILL.md:1

02
provision.py通过x402协议支付USDC

Escalation · scripts/provision.py:85

03
OWS CLI通过subprocess执行外部命令

Escalation · scripts/wallet_signing.py:107

04
curl|sh安装sgl CLI可能引入恶意代码（供应链攻击场景）

Impact · SKILL.md:469

What drove the risk score up

curl|sh远程脚本执行 +15

SKILL.md:469 记录 curl -sSf https://grid.x402compute.cc/install.sh | sh，供应链攻击向量

依赖无版本锁定 +10

requirements.txt 使用 >= 形式，可能安装含漏洞的更新版本

凭证本地文件写入 +8

get_one_time_password.py 将密码写入 .compute_password_{instance_id}，模式600

OWS后备使用npx下载 +7

wallet_signing.py:109 优先本地ows，其次npx运行时下载

Most important evidence

High Supply Chain

远程脚本管道执行

SKILL.md文档中记录了危险的curl|sh模式安装sgl CLI。虽然这是官方工具的官方安装方式，但存在供应链攻击风险。

SKILL.md:469
建议预先下载并验证安装脚本，或使用brew等包管理器安装
Medium Supply Chain

依赖无版本锁定

requirements.txt使用>=形式版本约束，可能安装含有安全漏洞的更新版本依赖

requirements.txt:1
锁定精确版本以防止依赖更新引入漏洞
Medium Sensitive Access

凭证写入本地文件

get_one_time_password.py将实例密码写入 .compute_password_{instance_id} 文件，模式600。虽然是一次性凭证，但文件系统中的敏感数据仍是风险点

scripts/get_one_time_password.py:58
考虑使用keyring或其他安全凭证存储替代文件写入
Medium RCE

OWS CLI通过subprocess执行

wallet_signing.py通过subprocess调用ows命令，存在命令注入风险（虽然当前实现看起来安全）

scripts/wallet_signing.py:107
验证参数避免注入，确保OWS_BIN路径可信
Low Priv Escalation

npx运行时下载OWS后备

wallet_signing.py在本地ows不可用时会通过npx下载@open-wallet-standard/core包，存在供应链风险

scripts/wallet_signing.py:111
优先要求用户预装OWS，将npx后备作为明确可选功能
Info Doc Mismatch

文档未明确说明网络请求的写性质

SKILL.md声明WebFetch为READ，但代码中所有网络请求都是POST/GET/DELETE等写操作。虽是合法API调用，但权限映射不准确

SKILL.md:32
明确说明网络操作用于API调用而非数据抓取

Declared capability vs actual capability

Filesystem Pass
Declared WRITE
→
Inferred WRITE
SKILL.md:allowed-tools包含Write；代码写入配置和凭证文件
Network Block
Declared READ
→
Inferred WRITE
代码发送HTTP请求（POST/GET）到API端点，但SKILL.md声明WebFetch为READ-only
Shell Pass
Declared WRITE
→
Inferred WRITE
wallet_signing.py:107使用subprocess执行ows命令；文档记录curl|sh安装命令
Environment Pass
Declared READ
→
Inferred READ
代码读取PRIVATE_KEY、SOLANA_SECRET_KEY等环境变量用于签名
Skill Invoke Pass
Declared NONE
→
Inferred NONE
无跨技能调用

Suspicious artifacts and egress

Critical Dangerous Command
curl -sSf https://grid.x402compute.cc/install.sh | sh

SKILL.md:469

High IP Address
1.2.3.4

references/api-reference.md:233

Medium External URL
https://docs.x402layer.cc/agentic-access/x402-compute

SKILL.md:22

Medium External URL
https://cloud.x402compute.cc

SKILL.md:26

Medium External URL
https://compute.x402layer.cc

SKILL.md:71

Medium External URL
https://grid.x402compute.cc

SKILL.md:73

Medium External URL
https://staking.x402layer.cc

SKILL.md:84

Medium External URL
https://compute.x402layer.cc/compute/provision

SKILL.md:216

Medium External URL
https://compute.x402layer.cc/compute/instances/

SKILL.md:257

Medium External URL
https://compute.x402layer.cc/compute/credits/topup

SKILL.md:304

Medium External URL
https://compute.x402layer.cc/compute/credits/balance

SKILL.md:311

Medium External URL
https://grid.x402compute.cc/v1/models

SKILL.md:436

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
eth-account >=0.8.0 pip No 无版本锁定
web3 >=6.0.0 pip No 无版本锁定
requests >=2.28.0 pip No 无版本锁定
python-dotenv >=1.0.0 pip No 无版本锁定
solders >=0.20.0 pip No 无版本锁定
@open-wallet-standard/core 0.5.0 npm No OWS可选依赖，npx后备

File composition

18 files · 3163 lines
Python 13 files · 1838 linesMarkdown 4 files · 1320 linesText 1 files · 5 lines
Files of concern · 6
scripts/get_one_time_password.py Python · 72 lines
凭证写入本地文件
SKILL.md Markdown · 551 lines
远程脚本管道执行 · 文档未明确说明网络请求的写性质 · curl -sSf https://grid.x402compute.cc/install.sh | sh · https://docs.x402layer.cc/agentic-access/x402-compute · https://cloud.x402compute.cc · https://compute.x402layer.cc · https://grid.x402compute.cc · https://staking.x402layer.cc · https://compute.x402layer.cc/compute/provision · https://compute.x402layer.cc/compute/instances/ · https://compute.x402layer.cc/compute/credits/topup · https://compute.x402layer.cc/compute/credits/balance · https://grid.x402compute.cc/v1/models · https://grid.x402compute.cc/grid/capacity · https://grid.x402compute.cc/v1/chat/completions · https://grid.x402compute.cc/v1 · https://grid.x402compute.cc/install.sh · https://docs.x402layer.cc/cloud/provide/node-setup · https://x402compute.cc
scripts/wallet_signing.py Python · 465 lines
OWS CLI通过subprocess执行 · npx运行时下载OWS后备 · 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
references/api-reference.md Markdown · 484 lines
1.2.3.4 · https://grid.x402compute.cc/v1/providers?model=llama-3.2-3b · https://grid.x402compute.cc/grid/nodes/
scripts/solana_signing.py Python · 306 lines
https://api.mainnet-beta.solana.com · 11111111111111111111111111111111
references/node-operator.md Markdown · 193 lines
https://docs.x402layer.cc/staking/introduction · https://docs.x402layer.cc/cloud/provide/earnings · https://docs.x402layer.cc/cloud/provide/requirements · https://docs.x402layer.cc/cloud/provide/cli · https://docs.x402layer.cc/cloud/provide/staking
Other files · provision.py · extend_instance.py · ows_cli.py · resize_instance.py · openwallet-ows.md · destroy_instance.py

Security positives

代码开源透明，所有网络请求指向官方域名
私钥仅用于本地签名，从不传输到网络
文档详尽，包含安全警告（使用专用钱包）
支付使用标准x402协议，有防重放机制
无隐藏的凭证外泄代码
一次性密码机制合理（仅返回一次，写入后设权限）
SKILL.md中明确声明了curl|sh行为，无阴影功能