安全决策报告
skill-publisher
SKILL.md metadata and documentation directly contradict the actual implementation: metadata declares `requires_api_key: false` while `upload_to_github.py` contains a hardcoded GitHub Personal Access Token, and the SKILL.md only describes `clawhub` CLI / `gh` CLI / `git push` workflows — never mentioning the Python script that performs undeclared HTTP network access.
最直接的威胁证据
严重 凭证窃取
Hardcoded GitHub Personal Access Token A real GitHub PAT (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) is hardcoded in plaintext at upload_to_github.py:7. Any agent with filesystem:READ access to the skill directory can extract this token and use it to authenticate as the token owner on GitHub, enabling repository creation, file uploads, releases, and code manipulation under the owner's account.
upload_to_github.py:7 为什么得出这个结论
3/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 5 步攻击链，另有 4 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
攻击链
01
Agent with filesystem:READ access reads upload_to_github.py from the skill directory
初始入口 · upload_to_github.py:7
02
Agent extracts hardcoded GitHub PAT (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) and BASE_DIR path
reconnaissance · upload_to_github.py:7
03
Agent uses PAT to authenticate with GitHub API as the token owner (EdwardWason)
持久化 · upload_to_github.py:15
04
Agent creates/modifies repositories, uploads files, creates releases, or exfiltrates repository contents under EdwardWason's account
最终危害 · upload_to_github.py:37
05
Agent reads local files from BASE_DIR (d:\TRAE SOLO CN\project\skill-publisher) and uploads them or uses them for further attacks
最终危害 · upload_to_github.py:66
风险分是怎么被拉高的
Credential exposure — hardcoded GitHub PAT +30
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 hardcoded at upload_to_github.py:7; token can be harvested by any agent with filesystem:READ access to the skill directory
SKILL.md metadata vs code mismatch +20
SKILL.md frontmatter declares requires_api_key: false but upload_to_github.py contains a real PAT; SKILL.md only documents CLI-based workflows (clawhub/gh CLI/git push), never mentions the Python script
Undeclared network:WRITE access +10
upload_to_github.py makes direct HTTPS API calls to github.com — this capability is not declared anywhere in SKILL.md
Hardcoded local path exposure +5
BASE_DIR = r'd:\TRAE SOLO CN\project\skill-publisher' at line 9 exposes the author's Windows username and absolute project path; violates SKILL.md Layer 2 local-path scan rules
最关键的证据
严重 凭证窃取
Hardcoded GitHub Personal Access Token
A real GitHub PAT (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) is hardcoded in plaintext at upload_to_github.py:7. Any agent with filesystem:READ access to the skill directory can extract this token and use it to authenticate as the token owner on GitHub, enabling repository creation, file uploads, releases, and code manipulation under the owner's account.
upload_to_github.py:7 Remove the hardcoded token. Use environment variables (os.environ.get('GITHUB_TOKEN')), gh CLI credential cache, or a .env.local file excluded from distribution. Rotate the exposed token immediately via GitHub Settings > Personal Access Tokens.
严重 文档欺骗
SKILL.md metadata declares no API key needed; code contains a real PAT
SKILL.md frontmatter has metadata.requires_api_key: false, yet upload_to_github.py embeds a live GitHub PAT. The SKILL.md also only documents CLI-based publishing workflows (clawhub CLI, gh CLI, git push, gh api) — it never mentions the Python script. This creates a false impression of the skill's actual capabilities and security posture.
SKILL.md:3 Update metadata.requires_api_key to true if using REST API methods, or remove the Python script and document only CLI-based workflows. Add an explicit 'Maintenance Tools' section listing upload_to_github.py with its purpose.
高危 敏感访问
Hardcoded Windows absolute path exposing author identity
BASE_DIR = r'd:\TRAE SOLO CN\project\skill-publisher' at upload_to_github.py:9 encodes the author's Windows username ('TRAE SOLO CN') and absolute project path. This violates SKILL.md Layer 2 local-path scan rules and leaks the author's machine identity.
upload_to_github.py:9 Remove BASE_DIR entirely. Derive the skill root directory dynamically (e.g., relative to the script location via __file__) or from an environment variable.
高危 文档欺骗
Undeclared Python script bypasses documented CLI-only workflows
upload_to_github.py implements direct GitHub REST API file uploads using urllib.request and base64 encoding. SKILL.md Phase 3 Step 10 documents a push fallback chain: git push → gh CLI → REST API (as a last resort), but never describes the Python script or its file-reading/uploading behavior. The script is present in the skill root alongside SKILL.md, implying it may be intended for use by agents operating in this skill directory.
upload_to_github.py:1 Either document upload_to_github.py explicitly as a maintainer tool (with a clear disclaimer it is for the skill author only and excluded from distributions), or remove it and rely solely on the documented CLI-based workflows.
中危 供应链
No dependency pinning in publish script
upload_to_github.py uses only standard library modules (urllib.request, json, base64, os, time) — no external dependencies to pin. However, the skill has no requirements.txt or package.json, making it unclear what pip/npm packages the skill itself depends on at runtime.
upload_to_github.py:1 If the skill has runtime Python dependencies, create a requirements.txt with pinned versions. Document any pip/npm package requirements in SKILL.md.
声明能力 vs 实际能力
文件系统 通过
声明 NONE
→ 推断 READ
upload_to_github.py:66 reads local files via read_local_file() 网络访问 阻止
声明 NONE
→ 推断 WRITE
upload_to_github.py:15-31 makes authenticated HTTPS requests to api.github.com; SKILL.md only documents CLI tools 环境变量 通过
声明 NONE
→ 推断 NONE
No env iteration observed 技能调用 通过
声明 READ
→ 推断 READ
SKILL.md defines triggers and workflow steps 可疑产物与外联
严重 API 密钥
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 upload_to_github.py:7
中危 外部 URL
https://img.shields.io/github/stars/EdwardWason/skill-publisher?style=flat-square README.en.md:5
中危 外部 URL
https://img.shields.io/badge/license-MIT--0-green?style=flat-square README.en.md:6
中危 外部 URL
https://img.shields.io/badge/ClawHub-skill--publisher-orange?style=flat-square README.en.md:7
中危 外部 URL
https://clawhub.ai/skills/skill-publisher README.en.md:7
中危 外部 URL
https://img.shields.io/badge/Claude%20Code-Skill-blue?style=flat-square README.en.md:8
中危 外部 URL
https://img.shields.io/github/stars/ references/repo-structure.md:64
中危 外部 URL
https://img.shields.io/badge/ClawHub- references/repo-structure.md:66
中危 外部 URL
https://clawhub.ai/skills/ references/repo-structure.md:66
中危 外部 URL
https://evil.com/collect?data=... references/security-audit.md:50
中危 外部 URL
https://clawhub.ai/user/edwardwason skill-card.md:7
中危 外部 URL
https://clawhub.ai/edwardwason/skill-publisher-ai skill-card.md:27
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| urllib.request | stdlib | Python standard library | 否 | No external dependencies — only stdlib used |
| json | stdlib | Python standard library | 否 | stdlib |
| base64 | stdlib | Python standard library | 否 | stdlib |
| os | stdlib | Python standard library | 否 | stdlib |
| time | stdlib | Python standard library | 否 | stdlib |
文件构成
12 个文件 · 2486 行
Markdown 10 个文件 · 2301 行Python 1 个文件 · 180 行JSON 1 个文件 · 5 行
需关注文件 · 7
SKILL.md SKILL.md metadata declares no API key needed; code contains a real PAT
references/repo-structure.md https://img.shields.io/github/stars/ · https://img.shields.io/badge/ClawHub- · https://clawhub.ai/skills/
references/publish-procedures.md README.en.md https://img.shields.io/github/stars/EdwardWason/skill-publisher?style=flat-square · https://img.shields.io/badge/license-MIT--0-green?style=flat-square · https://img.shields.io/badge/ClawHub-skill--publisher-orange?style=flat-square · https://clawhub.ai/skills/skill-publisher · https://img.shields.io/badge/Claude%20Code-Skill-blue?style=flat-square
upload_to_github.py Hardcoded GitHub Personal Access Token · Hardcoded Windows absolute path exposing author identity · Undeclared Python script bypasses documented CLI-only workflows · No dependency pinning in publish script · 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
references/security-audit.md https://evil.com/collect?data=... · [email protected]
skill-card.md https://clawhub.ai/user/edwardwason · https://clawhub.ai/edwardwason/skill-publisher-ai
其他文件 · changelog-generation.md · README.md · change-detection.md · CHANGELOG.md · _meta.json
安全亮点
Security audit procedures are well-documented in references/security-audit.md with clear PASS/FAIL criteria for credential leaks, local paths, and dangerous commands
Distribution judgment criteria are thorough, correctly identifying maintainer tools (like publish scripts) as should-be-excluded from distributions
SKILL.md explicitly blocks publishing on any security scan FAIL, which is a good defensive design
CLONE: The skill properly documents and recommends gh CLI as the preferred authentication method over token-in-URL or hardcoded tokens
SKILL.md requires user confirmation for repository name, account, visibility, slug, and version before publishing — a good safety gate