安全决策报告
sa-master
Skill includes an undeclared shell script (call_tool.sh) that executes local bash commands, exposes a hardcoded API key in config.json, and connects to an external MCP service with limited data-handling transparency.
最直接的威胁证据
01
Skill packaged with hardcoded bearer token in config.json 初始入口 · mcp-proxy/config.json
02
Undeclared shell script call_tool.sh executes bash+curl+python3 locally 权限提升 · mcp-proxy/call_tool.sh
03
Business architecture documents exfiltrated to external MCP service https://mcp.smartmoves.com.cn/sa/mcp 最终危害 · SKILL.md
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 3 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 4 步攻击链，另有 1 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
攻击链
01
Skill packaged with hardcoded bearer token in config.json
初始入口 · mcp-proxy/config.json:2
02
Undeclared shell script call_tool.sh executes bash+curl+python3 locally
权限提升 · mcp-proxy/call_tool.sh:1
03
Business architecture documents exfiltrated to external MCP service https://mcp.smartmoves.com.cn/sa/mcp
最终危害 · SKILL.md:91
04
Bearer token credentials sent with every request to external service
最终危害 · mcp-proxy/call_tool.sh:72
风险分是怎么被拉高的
Undeclared shell execution capability +20
call_tool.sh enables bash+curl execution but is not mentioned in SKILL.md capabilities or tool declarations
Hardcoded credential exposure +15
Bearer token sk-Wp9mTx4KvRn7Qd3Fzj embedded in config.json and referenced in SKILL.md
External service data exfiltration risk +10
Architecture documents and business assets sent to https://mcp.smartmoves.com.cn/sa/mcp with unclear data handling
No allowed-tools mapping +5
No pi.yaml or equivalent declaring filesystem/shell/network permissions
最关键的证据
高危 凭证窃取
Hardcoded bearer token in config.json
The file mcp-proxy/config.json contains a hardcoded API key 'sk-Wp9mTx4KvRn7Qd3Fzj'. This credential is also embedded in SKILL.md documentation, creating a permanent exposure risk.
mcp-proxy/config.json:2 Remove api_key from config.json entirely. Require users to provide their own API key via environment variable (e.g., MCP_API_KEY) or user configuration. SKILL.md should instruct users to supply credentials, not embed them.
中危 文档欺骗
Undeclared shell script execution capability
mcp-proxy/call_tool.sh is a bash script that executes local shell commands (bash, curl, python3) but this capability is not declared in SKILL.md under tool declarations or permissions. The SKILL.md only mentions MCP tools without referencing any local script execution.
mcp-proxy/call_tool.sh:1 Either remove call_tool.sh if not needed, or explicitly declare shell/bash:WRITE capability in SKILL.md with clear documentation of the use case.
中危 数据外泄
Architecture documents sent to external MCP service with unclear data retention
The skill sends business requirements, architecture documents, and design artifacts to a remote MCP service at https://mcp.smartmoves.com.cn/sa/mcp. skill-card.md acknowledges this risk but provides no details about data retention, processing, or third-party sharing policies.
SKILL.md:91 Before using this skill in production, verify the external service's data-handling policies. Consider self-hosting the MCP service if data confidentiality is critical. Add explicit data classification guidance in SKILL.md.
低危 权限提升
No allowed-tools declaration file present
No pi.yaml or equivalent allowed-tools mapping file exists in the skill package. Without explicit permission declarations, the runtime cannot verify that shell access granted to call_tool.sh is intentional and scoped.
. Add a pi.yaml file declaring allowed tools and resource permissions (e.g., shell:WRITE for call_tool.sh, network:WRITE for MCP calls) to provide transparency and enable permission verification.
声明能力 vs 实际能力
命令执行 阻止
声明 NONE
→ 推断 WRITE
mcp-proxy/call_tool.sh:1 — bash script executes curl commands to remote endpoint 网络访问 通过
声明 READ
→ 推断 WRITE
SKILL.md declares MCP service usage; call_tool.sh sends JSON-RPC requests 文件系统 通过
声明 NONE
→ 推断 NONE
Skill outputs documents but no filesystem permissions declared; call_tool.sh creates .tmp directory 可疑产物与外联
中危 外部 URL
https://mcp.smartmoves.com.cn/sa/mcp SKILL.md:82
中危 外部 URL
https://clawhub.ai/user/leo21cn skill-card.md:7
中危 外部 URL
https://clawhub.ai/leo21cn/skills/sa-master skill-card.md:29
依赖与供应链
没有结构化依赖告警。
文件构成
5 个文件 · 359 行
Shell 1 个文件 · 180 行Markdown 2 个文件 · 173 行JSON 2 个文件 · 6 行
需关注文件 · 4
mcp-proxy/config.json Hardcoded bearer token in config.json
SKILL.md Architecture documents sent to external MCP service with unclear data retention · https://mcp.smartmoves.com.cn/sa/mcp
mcp-proxy/call_tool.sh Undeclared shell script execution capability
skill-card.md https://clawhub.ai/user/leo21cn · https://clawhub.ai/leo21cn/skills/sa-master
其他文件 · _meta.json
安全亮点
skill-card.md acknowledges the risk of exposed bearer tokens and external data sharing, demonstrating some security awareness
The call_tool.sh script uses temporary files in a dedicated .tmp subdirectory rather than system /tmp
No base64-encoded payloads or obfuscated code patterns observed
No evidence of credential harvesting from environment variables or sensitive paths like ~/.ssh