Skill Trust Decision
clawpi-redpacket-monitor
ClawPI红包自动领取工具存在多处文档-行为差异，读取钱包JWT凭证并自动发布庆祝动态未在SKILL.md中声明，硬编码绝对路径暴露目标用户环境
Most direct threat evidence
High Doc Mismatch
未声明的JWT凭证读取 getJWT()方法从~/.fluxa-ai-wallet-mcp/config.json读取JWT token用于API认证，但SKILL.md中完全没有提及此行为。用户安装此技能即意味着授权读取其钱包配置文件中的敏感凭证
scripts/monitor.cjs:65 Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
3 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
3 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
What drove the risk score up
未声明的JWT凭证读取 +12
getJWT()读取~/.fluxa-ai-wallet-mcp/config.json获取JWT，但SKILL.md未提及
未声明的自动发布动态 +10
postCelebrationMoment()自动发布庆祝内容到用户账号，文档未声明
硬编码绝对路径 +8
statusFile硬编码为/Users/xufan65/.openclaw/workspace/memory/，暴露目标用户
外部命令依赖未声明 +5
依赖fluxa-wallet CLI和openclaw命令，但文档未提及
自动领取无用户确认 +3
autoClaim默认开启，领取行为不可逆
Most important evidence
High Doc Mismatch
未声明的JWT凭证读取
getJWT()方法从~/.fluxa-ai-wallet-mcp/config.json读取JWT token用于API认证，但SKILL.md中完全没有提及此行为。用户安装此技能即意味着授权读取其钱包配置文件中的敏感凭证
scripts/monitor.cjs:65 在SKILL.md的能力声明中明确列出'读取钱包配置文件获取认证凭证'
Medium Doc Mismatch
未声明的自动发布动态行为
postCelebrationMoment()方法会自动创建并发布庆祝动态到用户账号，内容为固定模板'哇！刚刚从XX那里抢到了XX USDC的红包...'，此行为未在SKILL.md中声明
scripts/monitor.cjs:156 明确告知用户会自动发布动态，或提供opt-out选项
Medium Sensitive Access
硬编码的绝对路径暴露目标环境
statusFile路径硬编码为'/Users/xufan65/.openclaw/workspace/memory/clawpi-redpacket-status.json'，包含明确的用户名'xufan65'，暴露了目标用户环境信息
scripts/monitor.cjs:41 使用相对路径或环境变量，移除硬编码用户名
Low Supply Chain
外部CLI命令依赖未声明
脚本依赖fluxa-wallet和openclaw CLI工具，但package.json和SKILL.md均未声明这些依赖
scripts/monitor.cjs:107 在文档中添加依赖说明
Low Priv Escalation
无用户确认的自动操作
autoClaim默认为true，领取红包是不可逆的金融操作，没有用户确认步骤直接执行
scripts/monitor.cjs:44 添加用户确认机制或明确的风险提示
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred READ
scripts/monitor.cjs:34,41 读写状态文件 Network Block
Declared NONE
→ Inferred WRITE
scripts/monitor.cjs:85,130,156 调用外部API进行读/写操作 Shell Block
Declared NONE
→ Inferred WRITE
scripts/monitor.cjs:87,107,178 使用execSync执行curl和CLI命令 Environment Block
Declared NONE
→ Inferred READ
scripts/monitor.cjs:65-73 读取fluxa钱包配置文件获取JWT Suspicious artifacts and egress
Medium External URL
https://clawpi-v2.vercel.app/api/redpacket/available?n=20&offset=0 scripts/monitor.cjs:85
Medium External URL
https://clawpi-v2.vercel.app/api/redpacket/claim scripts/monitor.cjs:130
Medium External URL
https://clawpi-v2.vercel.app/api/moments/create scripts/monitor.cjs:156
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| node (runtime) | N/A | system | No | 依赖系统Node.js运行时 |
| fluxa-wallet | N/A | external CLI | No | 外部CLI工具，SKILL.md未声明依赖 |
| openclaw | N/A | external CLI | No | 外部CLI工具，用于Discord通知 |
File composition
4 files · 462 lines
JavaScript 1 files · 287 linesMarkdown 1 files · 148 linesJSON 2 files · 27 lines
Files of concern · 1
scripts/monitor.cjs 未声明的JWT凭证读取 · 未声明的自动发布动态行为 · 硬编码的绝对路径暴露目标环境 · 外部CLI命令依赖未声明 · 无用户确认的自动操作 · https://clawpi-v2.vercel.app/api/redpacket/available?n=20&offset=0 · https://clawpi-v2.vercel.app/api/redpacket/claim · https://clawpi-v2.vercel.app/api/moments/create
Other files · SKILL.md · package.json · settings.json
Security positives
功能实现与SKILL.md描述的核心监控-领取流程一致
状态持久化设计合理，避免重复领取
有基本的错误处理机制
使用Discord通知用户，保持透明度
无恶意代码特征（无base64、无反向shell、无凭证外传）