安全决策报告
agile-workflow
The skill is a legitimate novel writing workflow engine but has undeclared shell execution, process management capabilities, and extensive hardcoded paths that create security posture concerns without explicit capability declarations in SKILL.md.
最直接的威胁证据
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
通过
攻击链与高危发现
没有形成明确的恶意路径。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
风险分是怎么被拉高的
Undeclared shell execution +20
SKILL.md describes spawning agents via CLI but does not declare shell:WRITE in capability mapping
Undeclared process management +12
GlobalProcessManager can SIGKILL processes without documentation
Broad filesystem access +8
Accesses /home/ubutu/.openclaw/ directory and session files without explicit declaration
Hardcoded environment paths +5
Multiple hardcoded paths like /home/ubutu/.npm-global/bin/openclaw indicate narrow deployment scope
No credential theft or data exfiltration +-15
No evidence of credential harvesting or external data exfiltration
Legitimate workflow functionality +-8
All observed behaviors align with described novel writing workflow engine purpose
最关键的证据
中危 文档欺骗
Undeclared Shell Execution Capability
SKILL.md describes spawning 'openclaw agent' via CLI but does not declare shell:WRITE in the capability mapping. The code uses exec() and spawn() to run shell commands.
core/task-scheduler.js:175 Add shell:WRITE to capability mapping if shell execution is intended
中危 权限提升
Undeclared Process Termination Capability
GlobalProcessManager.cleanupOrphanProcesses() can kill processes via SIGKILL. This process termination capability is not declared in SKILL.md.
core/global-process-manager.js:47 Document process management capabilities or scope to prevent misuse
低危 敏感访问
Access to Session Files in .openclaw Directory
log-monitor.js accesses session files at /home/ubutu/.openclaw/agents/*/sessions for cleanup. This accesses agent workspace files.
core/log-monitor.js:127 Document this access as legitimate session management behavior
低危 持久化
Daemon Processes with Cron Setup
SKILL.md recommends crontab entries for monitor (every minute), learn (every 6 hours), and auto-spec-discovery. These create persistent background processes.
SKILL.md:69 This is legitimate for a workflow engine but should be clearly documented
提示 文档欺骗
Pre-scan IOC Flag: rm -rf /
The pre-scan flagged 'rm -rf / @ docs/DELIVERY-CHECKLIST.md:256' as critical IOC. Upon review, this is actually documentation of a cleanup command: 'rm -rf /tmp/concurrent-executor-*' which is legitimate temporary file cleanup.
docs/DELIVERY-CHECKLIST.md:256 False positive - the '@' is likely from Markdown rendering, not actual command syntax
声明能力 vs 实际能力
命令执行 阻止
声明 NONE
→ 推断 WRITE
core/task-scheduler.js:9 exec() spawns openclaw CLI 文件系统 阻止
声明 NONE
→ 推断 WRITE
core/agent-process-pool.js:298 writes task outputs to project directories 进程 阻止
声明 NONE
→ 推断 WRITE
core/global-process-manager.js:47 can SIGKILL processes 网络访问 通过
声明 NONE
→ 推断 NONE
No direct network requests in code credential 通过
声明 NONE
→ 推断 NONE
No credential harvesting observed 可疑产物与外联
严重 危险命令
rm -rf / docs/DELIVERY-CHECKLIST.md:256
中危 外部 URL
https://opencollective.com/ioredis package-lock.json:77
中危 外部 URL
https://clawhub.com/skills/agile-workflow package.json:39
中危 外部 URL
https://clawhub.ai/user/XBCS skill-card.md:7
中危 外部 URL
https://clawhub.ai/XBCS/agile-workflow skill-card.md:27
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| ioredis | ^5.10.0 | npm | 否 | Only dependency, semver range allows updates |
文件构成
141 个文件 · 51630 行
JavaScript 66 个文件 · 26974 行Markdown 65 个文件 · 23567 行HTML 1 个文件 · 669 行JSON 7 个文件 · 328 行Shell 2 个文件 · 92 行
需关注文件 · 3
docs/ADD-v7.18-Token 超限修复.md docs/ADD-v7.22-Token 超限紧急修复.md core/token-counter.js 其他文件 · health-check-v2.js · health-check.js · self-healing-monitor.js · agent-process-pool.js · agile-workflow-engine-v5.js · ADD-v7.0-并发安全架构.md +3
安全亮点
No credential harvesting or API key theft observed
No data exfiltration to external servers
No base64-encoded obfuscation or reverse shell code
No unauthorized access to sensitive paths like ~/.ssh or .env
All file operations are within the intended workflow engine scope
Process management is scoped to workflow-related agents
No evidence of C2 communication or data theft