安全决策报告
yqzl-ai-service
The skill implements automatic code updates that download and execute arbitrary code from an external Convex backend without explicit user consent, combined with undeclared network behavior and filesystem writes, presenting significant supply chain and execution risks.
最直接的威胁证据
01
Skill is installed via ClawSafe platform with user consent 初始入口 · SKILL.md
02
On first api_client.py execution, auto_check_and_notify() silently downloads latest version 持久化 · scripts/api_client.py
03
Code downloaded from Convex backend (wry-manatee-359.convex.site) and extracted to temp directory supply_chain · scripts/updater.py
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 4 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 4 步攻击链，另有 2 项高危或严重发现。
复核
依赖与供应链卫生
发现 1 项需要关注的依赖或供应链线索。
攻击链
01
Skill is installed via ClawSafe platform with user consent
初始入口 · SKILL.md:1
02
On first api_client.py execution, auto_check_and_notify() silently downloads latest version
持久化 · scripts/api_client.py:1293
03
Code downloaded from Convex backend (wry-manatee-359.convex.site) and extracted to temp directory
supply_chain · scripts/updater.py:258
04
_apply_update() replaces skill files and updates version number without user consent
privilege_escalation · scripts/updater.py:296
风险分是怎么被拉高的
Undeclared auto-upgrade with code execution +35
updater.py automatically downloads and executes code from Convex backend on startup without explicit user consent
Supply chain risk +20
Skill downloads latest version from external URL on every 24h auto-check, no version pinning
Undeclared filesystem writes +10
Creates backups in backup/ directory, writes .update_state.json without clear documentation
Hardcoded external download URL +5
wry-manatee-359.convex.site URL is not mentioned in SKILL.md documentation
最关键的证据
高危 供应链
Automatic code download and execution without consent
The auto_check_and_notify() function in updater.py is called on every api_client.py startup, automatically downloading and installing new versions from a Convex backend without user interaction or consent. The skill replaces its own code files via _do_replace() after extraction.
scripts/updater.py:196 Require explicit user consent before downloading and applying updates. Add a --no-auto-upgrade flag. Document the auto-update behavior prominently in SKILL.md with clear opt-out instructions.
高危 供应链
No version pinning for external code downloads
The DEFAULT_DOWNLOAD_URL always fetches 'latest' version from the Convex backend. If the backend is compromised or the domain expires, attackers could serve malicious code to all installed instances.
scripts/updater.py:24 Pin to a specific version hash or use signed manifests to verify downloaded code integrity.
中危 文档欺骗
Documentation mismatch on auto-upgrade behavior
SKILL.md states '启动时自动检测...发现新版本立即升级后再使用' but does not clearly warn users that this involves downloading and executing arbitrary code. The '自动升级' section understates the security implications.
SKILL.md:108 Add prominent security warnings about automatic code execution, similar to how curl|bash warnings are handled in other contexts.
中危 权限提升
Undeclared filesystem modifications
The updater creates backup directories, writes state files (.update_state.json), and replaces skill files without these operations being declared in SKILL.md capabilities or file access documentation.
scripts/updater.py:81 Document all filesystem modifications, especially backup creation and file replacement operations.
低危 敏感访问
Undeclared environment variable access
The updater reads YQZL_AI_DOWNLOAD_URL from environment variables without documentation. This could allow manipulation of update source if the environment is controlled by an attacker.
scripts/updater.py:25 Document all environment variables used. Consider rejecting environment variable overrides in production unless explicitly required.
声明能力 vs 实际能力
网络访问 通过
声明 READ
→ 推断 READ
SKILL.md declares API calls; api_client.py:43-44 文件系统 阻止
声明 WRITE
→ 推断 WRITE
SKILL.md declares HTML generation only; updater.py writes backup/, .update_state.json, skill files without explicit declaration 命令执行 通过
声明 NONE
→ 推断 NONE
No shell execution observed 环境变量 通过
声明 NONE
→ 推断 READ
updater.py:25 reads YQZL_AI_DOWNLOAD_URL env var without documentation 可疑产物与外联
中危 外部 URL
https://www.yunqi-zhilian.com/AIService/experience/page SKILL.md:4
中危 外部 URL
https://www.yunqi-zhilian.com/ SKILL.md:75
中危 外部 URL
https://www.yunqi-zhilian.com/AIService scripts/api_client.py:43
中危 外部 URL
https://wry-manatee-359.convex.site/api/v1/download?slug=yqzl-ai-service scripts/updater.py:26
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| requests | not pinned | import | 否 | Used for HTTP requests, no version constraint specified |
| cryptography | not pinned | import | 否 | Used for Fernet encryption, no version constraint specified |
| Convex backend (external) | latest only | network | 否 | External supply chain risk - no version pinning or integrity verification |
文件构成
7 个文件 · 3910 行
Python 4 个文件 · 3618 行Markdown 1 个文件 · 286 行JSON 1 个文件 · 5 行Other 1 个文件 · 1 行
需关注文件 · 3
scripts/api_client.py https://www.yunqi-zhilian.com/AIService
SKILL.md Documentation mismatch on auto-upgrade behavior · https://www.yunqi-zhilian.com/AIService/experience/page · https://www.yunqi-zhilian.com/
scripts/updater.py Automatic code download and execution without consent · No version pinning for external code downloads · Undeclared filesystem modifications · Undeclared environment variable access · https://wry-manatee-359.convex.site/api/v1/download?slug=yqzl-ai-service
其他文件 · voucher_generator.py · config_manager.py · _meta.json · version
安全亮点
API key is encrypted using Fernet symmetric encryption with machine-derived key (reasonably secure)
Encryption key derivation uses machine-specific characteristics (hostname + username + salt)
No credential harvesting or environment variable enumeration observed
No base64-encoded execution, reverse shell, or direct IP network requests
No suspicious obfuscation patterns or eval() calls
Voucher generation is purely local processing with no external communication
API calls are made to a declared external service with documented endpoints