Skill Trust Decision
yqzl-ai-service
The skill implements automatic code updates that download and execute arbitrary code from an external Convex backend without explicit user consent, combined with undeclared network behavior and filesystem writes, presenting significant supply chain and execution risks.
Most direct threat evidence
01
Skill is installed via ClawSafe platform with user consent Entry · SKILL.md
02
On first api_client.py execution, auto_check_and_notify() silently downloads latest version Persistence · scripts/api_client.py
03
Code downloaded from Convex backend (wry-manatee-359.convex.site) and extracted to temp directory supply_chain · scripts/updater.py
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
4 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
Attack Chain
01
Skill is installed via ClawSafe platform with user consent
Entry · SKILL.md:1
02
On first api_client.py execution, auto_check_and_notify() silently downloads latest version
Persistence · scripts/api_client.py:1293
03
Code downloaded from Convex backend (wry-manatee-359.convex.site) and extracted to temp directory
supply_chain · scripts/updater.py:258
04
_apply_update() replaces skill files and updates version number without user consent
privilege_escalation · scripts/updater.py:296
What drove the risk score up
Undeclared auto-upgrade with code execution +35
updater.py automatically downloads and executes code from Convex backend on startup without explicit user consent
Supply chain risk +20
Skill downloads latest version from external URL on every 24h auto-check, no version pinning
Undeclared filesystem writes +10
Creates backups in backup/ directory, writes .update_state.json without clear documentation
Hardcoded external download URL +5
wry-manatee-359.convex.site URL is not mentioned in SKILL.md documentation
Most important evidence
High Supply Chain
Automatic code download and execution without consent
The auto_check_and_notify() function in updater.py is called on every api_client.py startup, automatically downloading and installing new versions from a Convex backend without user interaction or consent. The skill replaces its own code files via _do_replace() after extraction.
scripts/updater.py:196 Require explicit user consent before downloading and applying updates. Add a --no-auto-upgrade flag. Document the auto-update behavior prominently in SKILL.md with clear opt-out instructions.
High Supply Chain
No version pinning for external code downloads
The DEFAULT_DOWNLOAD_URL always fetches 'latest' version from the Convex backend. If the backend is compromised or the domain expires, attackers could serve malicious code to all installed instances.
scripts/updater.py:24 Pin to a specific version hash or use signed manifests to verify downloaded code integrity.
Medium Doc Mismatch
Documentation mismatch on auto-upgrade behavior
SKILL.md states '启动时自动检测...发现新版本立即升级后再使用' but does not clearly warn users that this involves downloading and executing arbitrary code. The '自动升级' section understates the security implications.
SKILL.md:108 Add prominent security warnings about automatic code execution, similar to how curl|bash warnings are handled in other contexts.
Medium Priv Escalation
Undeclared filesystem modifications
The updater creates backup directories, writes state files (.update_state.json), and replaces skill files without these operations being declared in SKILL.md capabilities or file access documentation.
scripts/updater.py:81 Document all filesystem modifications, especially backup creation and file replacement operations.
Low Sensitive Access
Undeclared environment variable access
The updater reads YQZL_AI_DOWNLOAD_URL from environment variables without documentation. This could allow manipulation of update source if the environment is controlled by an attacker.
scripts/updater.py:25 Document all environment variables used. Consider rejecting environment variable overrides in production unless explicitly required.
Declared capability vs actual capability
Network Pass
Declared READ
→ Inferred READ
SKILL.md declares API calls; api_client.py:43-44 Filesystem Block
Declared WRITE
→ Inferred WRITE
SKILL.md declares HTML generation only; updater.py writes backup/, .update_state.json, skill files without explicit declaration Shell Pass
Declared NONE
→ Inferred NONE
No shell execution observed Environment Pass
Declared NONE
→ Inferred READ
updater.py:25 reads YQZL_AI_DOWNLOAD_URL env var without documentation Suspicious artifacts and egress
Medium External URL
https://www.yunqi-zhilian.com/AIService/experience/page SKILL.md:4
Medium External URL
https://www.yunqi-zhilian.com/ SKILL.md:75
Medium External URL
https://www.yunqi-zhilian.com/AIService scripts/api_client.py:43
Medium External URL
https://wry-manatee-359.convex.site/api/v1/download?slug=yqzl-ai-service scripts/updater.py:26
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| requests | not pinned | import | No | Used for HTTP requests, no version constraint specified |
| cryptography | not pinned | import | No | Used for Fernet encryption, no version constraint specified |
| Convex backend (external) | latest only | network | No | External supply chain risk - no version pinning or integrity verification |
File composition
7 files · 3910 lines
Python 4 files · 3618 linesMarkdown 1 files · 286 linesJSON 1 files · 5 linesOther 1 files · 1 lines
Files of concern · 3
scripts/api_client.py https://www.yunqi-zhilian.com/AIService
SKILL.md Documentation mismatch on auto-upgrade behavior · https://www.yunqi-zhilian.com/AIService/experience/page · https://www.yunqi-zhilian.com/
scripts/updater.py Automatic code download and execution without consent · No version pinning for external code downloads · Undeclared filesystem modifications · Undeclared environment variable access · https://wry-manatee-359.convex.site/api/v1/download?slug=yqzl-ai-service
Other files · voucher_generator.py · config_manager.py · _meta.json · version
Security positives
API key is encrypted using Fernet symmetric encryption with machine-derived key (reasonably secure)
Encryption key derivation uses machine-specific characteristics (hostname + username + salt)
No credential harvesting or environment variable enumeration observed
No base64-encoded execution, reverse shell, or direct IP network requests
No suspicious obfuscation patterns or eval() calls
Voucher generation is purely local processing with no external communication
API calls are made to a declared external service with documented endpoints