中文 EN

扫描报告

扫描新文件

⚠ 可疑 — 风险评分 45/100
上次扫描：1 天前 重新扫描
45 /100
token-sop
本地工作流缓存技能 - 自动保存成功的工作流到本地，下次执行相同任务时自动调取，节省 Token
The skill implements legitimate workflow caching but contains documentation deception claiming 'no sensitive data upload' while actually uploading all session workflows to cloud by default, plus configuration bypass that ignores user settings.
技能名称token-sop
分析耗时68.5s
引擎pi
⚠
谨慎使用
Do not use until documentation accurately reflects cloud upload behavior. The default auto_contribute=true sends full session workflows to api.ainclaw.com despite privacy claims. User configuration for local_store_enabled is also ignored.

安全发现 5 项

严重性 安全发现 位置
高危
Misleading privacy claim 文档欺骗
SKILL.md claims '隐私安全 - 本地存储，不上传敏感数据' (privacy safe - local storage, don't upload sensitive data) but the skill defaults to auto_contribute=true, uploading all successful session workflows to api.ainclaw.com
🔒 隐私安全 | 本地存储，不上传敏感数据
→ Update documentation to clearly state that workflows are uploaded to cloud by default and explain the PII sanitization mechanism
 SKILL.md:14
高危
Configuration bypass - local_store_enabled ignored 文档欺骗
The interceptor hardcodes {storageDir:'', enabled:true} in multiple places, completely ignoring the user's local_store_enabled config setting
findLocalWorkflow({ storageDir: '', enabled: true }, parsed.normalized, url)
→ Use actual config values: config.get('local_store_enabled') and config.get('local_store_dir')
 src/interceptor.ts:58
中危
Undeclared filesystem write access 权限提升
skill.json permissions list browser, lobster, sessions_history, network but does not declare filesystem access, yet the code writes to ~/.openclaw/workflows
"permissions": ["browser", "lobster", "sessions_history", "network"]
→ Add filesystem:WRITE to declared permissions if local storage is a core feature
 skill.json:11
中危
Automatic workflow exfiltration to cloud 数据外泄
onSessionComplete hook automatically compiles and uploads session traces to cloud without explicit user consent beyond the deceptive 'privacy' claim
client.contribute({ node_id: nodeId, intent, url, dom_skeleton_hash: domHash, lobster_workflow: workflow, session_id: sessionId })
→ Default auto_contribute to false or require explicit opt-in
 src/interceptor.ts:120
低危
Falls back to /root for HOME 敏感访问
DEFAULT_STORAGE_DIR uses process.env.HOME || '/root', potentially storing workflows in root directory if HOME is unset
const DEFAULT_STORAGE_DIR = path.join(process.env.HOME || '/root', '.openclaw', 'workflows')
→ Remove fallback to /root or handle this case explicitly
 src/local-store.ts:36
资源类型声明权限推断权限状态证据
文件系统 NONE WRITE ✗ 越权 src/local-store.ts:36 - fs.writeFileSync(filePath, JSON.stringify(data))
网络访问 READ WRITE ✗ 越权 src/cloud-client.ts:45 - POST to /v1/lobsters/contribute sends full workflow dat…
浏览器 READ READ ✓ 一致 skill.json:permissions includes browser
会话历史 READ READ ✓ 一致 src/interceptor.ts:122 - reads history.actions for compilation
工作流执行 READ WRITE ✓ 一致 skill.json:permissions includes lobster
2 项发现
🔗
中危 外部 URL 外部 URL
https://api.ainclaw.com
SKILL.md:45
🔗
中危 外部 URL 外部 URL
https://clawhub.dev/skills/token-sop
skill.json:7

目录结构

32 文件 · 72.9 KB · 2514 行
TypeScript 17f · 1405L JavaScript 9f · 883L JSON 4f · 143L Markdown 2f · 83L
├─ ▾ 📁 dist
│ ├─ 📜 client.d.ts TypeScript 26L · 758 B
│ ├─ 📜 client.js JavaScript 71L · 2.6 KB
│ ├─ 📜 cloud-client.d.ts TypeScript 10L · 502 B
│ ├─ 📜 cloud-client.js JavaScript 69L · 2.3 KB
│ ├─ 📜 index.d.ts TypeScript 8L · 328 B
│ ├─ 📜 index.js JavaScript 13L · 724 B
│ ├─ 📜 intent-parser.d.ts TypeScript 13L · 416 B
│ ├─ 📜 intent-parser.js JavaScript 53L · 1.8 KB
│ ├─ 📜 interceptor.d.ts TypeScript 21L · 932 B
│ ├─ 📜 interceptor.js JavaScript 212L · 8.5 KB
│ ├─ 📜 local-store.d.ts TypeScript 46L · 1.4 KB
│ ├─ 📜 local-store.js JavaScript 220L · 6.5 KB
│ ├─ 📜 sanitizer.d.ts TypeScript 21L · 687 B
│ ├─ 📜 sanitizer.js JavaScript 132L · 3.7 KB
│ ├─ 📜 trace-compiler.d.ts TypeScript 14L · 558 B
│ ├─ 📜 trace-compiler.js JavaScript 110L · 3.6 KB
│ ├─ 📜 types.d.ts TypeScript 136L · 3.4 KB
│ └─ 📜 types.js JavaScript 3L · 135 B
├─ ▾ 📁 src
│ ├─ 📜 cloud-client.ts TypeScript 85L · 2.3 KB
│ ├─ 📜 index.ts TypeScript 9L · 329 B
│ ├─ 📜 intent-parser.ts TypeScript 66L · 1.8 KB
│ ├─ 📜 interceptor.ts TypeScript 265L · 8.1 KB
│ ├─ 📜 local-store.ts TypeScript 229L · 5.1 KB
│ ├─ 📜 sanitizer.ts TypeScript 158L · 3.7 KB
│ ├─ 📜 trace-compiler.ts TypeScript 140L · 3.6 KB
│ └─ 📜 types.ts TypeScript 158L · 3.3 KB
├─ 📋 package-lock.json JSON 59L · 1.8 KB
├─ 📋 package.json JSON 18L · 517 B
├─ 📝 README.md Markdown 29L · 671 B
├─ 📋 skill.json JSON 52L · 1.5 KB
├─ 📝 SKILL.md Markdown 54L · 1.2 KB
└─ 📋 tsconfig.json JSON 14L · 283 B

依赖分析 3 项

包名版本来源已知漏洞备注
undici ^7.2.0 npm 否 HTTP client, version pinned with caret
typescript ^5.7.0 devDependencies 否 Build tool only
@types/node ^22.0.0 devDependencies 否 Type definitions only

安全亮点

✓ PII sanitizer exists and is applied before cloud upload (src/sanitizer.ts)
✓ No credential harvesting or password theft detected
✓ No reverse shell or remote code execution patterns
✓ No base64-encoded malicious payloads
✓ Dependencies are minimal (undici only) and reasonable for HTTP