中文 EN
Start Review
Skill Trust Decision

swarm-control-feishu

配置管理工具存在危险文档模式（curl|bash）和过度权限设计，但代码本身无明显恶意行为

Install decision first Source: ClawHub Scanned: Apr 3, 2026
Files 15
Artifacts 12
Violations 0
Findings 4
Most direct threat evidence
01
用户通过 SKILL.md 文档获取安装指令 Entry · SKILL.md
02
文档中的 curl|bash 命令被替换为恶意脚本 URL Escalation · SKILL.md
03
用户执行恶意安装脚本获得远程代码执行 Impact · SKILL.md

Why this conclusion was reached

2/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 3 attack-chain steps and 0 severe findings.

Review
Dependencies and supply chain hygiene

4 dependency or supply-chain issues need attention.

Attack Chain

01
用户通过 SKILL.md 文档获取安装指令

Entry · SKILL.md:965

02
文档中的 curl|bash 命令被替换为恶意脚本 URL

Escalation · SKILL.md:965

03
用户执行恶意安装脚本获得远程代码执行

Impact · SKILL.md:965

What drove the risk score up

SKILL.md 中的 curl|bash 模式 +20

文档第965行使用 curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash 安装 nvm

全权限配置模板 +12

sandbox:off, exec.ask:off, elevated.enabled:true, fs.workspaceOnly:false 构成过度授权

文档-行为一致性 +5

代码执行 execSync('openclaw version') 等命令与文档描述基本一致

局域网绑定网关 +5

gateway.bind:lan 且 allowInsecureAuth:true 暴露局域网攻击面

Most important evidence

Medium

SKILL.md 文档中存在危险安装模式

在 SKILL.md 第965行展示了通过管道到 bash 安装 nvm 的危险命令，攻击者可将此模式替换为恶意脚本 URL

SKILL.md:965
使用官方包管理器安装 Node.js，而非通过管道到 bash 执行远程脚本
Medium

全权限配置模板过于宽松

FULL_CONFIG 设置 sandbox:off、exec.ask:off、elevated.enabled:true、fs.workspaceOnly:false，形成最高权限状态

feishu-allallow.js:131
分离开发和生产配置，提供安全默认值，明确告知用户风险
Low

网关暴露局域网访问

gateway.bind:lan 且 allowInsecureAuth:true，局域网内任何设备可访问控制面板

feishu-allallow.js:155
生产环境使用 localhost 或 VPN，禁用 allowInsecureAuth
Low

代码无版本锁定依赖

package.json 中依赖无版本锁定，funasr/onnxruntime/fastapi 等使用 * 版本

package.json
锁定依赖版本防止供应链攻击

Declared capability vs actual capability

Filesystem Pass
Declared WRITE
→
Inferred WRITE
feishu-allallow.js:55 readConfig()/writeConfig()
Shell Pass
Declared WRITE
→
Inferred WRITE
feishu-allallow.js:56 execSync('openclaw version')
Network Pass
Declared READ
→
Inferred READ
start-funasr.sh:37 Docker镜像下载
Environment Pass
Declared READ
→
Inferred READ
feishu-allallow.js:34 ENV对象检测
Skill Invoke Pass
Declared WRITE
→
Inferred WRITE
feishu-allallow.js:380-383 命令分发

Suspicious artifacts and egress

Critical Dangerous Command
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash

SKILL.md:965

Medium External URL
https://clawhub.com

CHANGELOG.md:101

Medium External URL
https://docs.openclaw.ai

FILES.md:139

Medium External URL
https://open.feishu.cn/

FILES.md:140

Medium External URL
http://127.0.0.1:18789

JSON_CONFIG_GUIDE.md:302

Medium External URL
https://api.kimi.com/coding/

JSON_CONFIG_GUIDE.md:328

Medium External URL
https://www.modelscope.cn/models/manyeyes/sensevoice-small-int8-onnx/summary

SKILL.md:712

Medium External URL
https://nodejs.org/en/download/

SKILL.md:1094

Medium External URL
https://www.python.org/downloads/

SKILL.md:1100

Medium External URL
https://f-droid.org/packages/com.termux/

SKILL.md:1135

Medium External URL
http://json-schema.org/draft-07/schema#

schema.json:2

Medium External URL
https://www.modelscope.cn/models/manyeyes/sensevoice-small-int8-onnx

start-funasr.sh:27

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
funasr * pip No 无版本锁定
onnxruntime * pip No 无版本锁定
fastapi * pip No 无版本锁定
uvicorn * pip No 无版本锁定

File composition

15 files · 4275 lines
Markdown 6 files · 2419 linesJavaScript 3 files · 1171 linesJSON 5 files · 626 linesShell 1 files · 59 lines
Files of concern · 6
SKILL.md Markdown · 1292 lines
SKILL.md 文档中存在危险安装模式 · curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash · https://www.modelscope.cn/models/manyeyes/sensevoice-small-int8-onnx/summary · https://nodejs.org/en/download/ · https://www.python.org/downloads/ · https://f-droid.org/packages/com.termux/
feishu-allallow.js JavaScript · 498 lines
全权限配置模板过于宽松 · 网关暴露局域网访问
JSON_CONFIG_GUIDE.md Markdown · 550 lines
http://127.0.0.1:18789 · https://api.kimi.com/coding/
schema.json JSON · 217 lines
http://json-schema.org/draft-07/schema#
FILES.md Markdown · 142 lines
https://docs.openclaw.ai · https://open.feishu.cn/
CHANGELOG.md Markdown · 107 lines
https://clawhub.com
Other files · feishu-prime.js · config.example.annotated.json · README.md · swarm-control-feishu.js · RELEASE.md · config.example.json

Security positives

代码结构清晰，功能明确为配置管理
无凭证收割、键盘记录等恶意行为
配置文件备份机制完善
支持多平台检测和环境适配
Docker 容器隔离语音服务