中文 EN
Start Review
Skill Trust Decision

klyc-pmm

KLYC-PMM has significant doc-to-code mismatches: pmm_distill.sh executes PHP code on the remote server via hardcoded paths, watch mode automatically exfiltrates file changes to kunlunyaochi.com, and credential access patterns are incompletely documented.

Install decision first Source: ClawHub Scanned: 9 days ago
Files 16
Artifacts 22
Violations 4
Findings 6
Most direct threat evidence
01
User runs oneclick.sh or init command recon · scripts/oneclick.sh
02
install-daemon.sh installs systemd service that survives reboots Persistence · scripts/install-daemon.sh
03
Watch mode automatically pushes file changes to kunlunyaochi.com Exfiltration · scripts/pmm_watch.sh

Why this conclusion was reached

2/4 dimensions flagged
Block
Declared vs actual capability

4 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

22 lower-risk artifacts were extracted and still need context.

Block
Attack chain and severe findings

The report includes 5 attack-chain steps and 3 severe findings.

Pass
Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

Attack Chain

01
User runs oneclick.sh or init command

recon · scripts/oneclick.sh:1

02
install-daemon.sh installs systemd service that survives reboots

Persistence · scripts/install-daemon.sh:95

03
Watch mode automatically pushes file changes to kunlunyaochi.com

Exfiltration · scripts/pmm_watch.sh:1190

04
pmm_distill.sh executes PHP on remote server accessing production DB

Escalation · scripts/pmm_distill.sh:64

05
Soft-delete operations mark records as deleted in remote database

Impact · scripts/pmm_distill.sh:113

What drove the risk score up

Undeclared server-side code execution +30

pmm_distill.sh writes PHP to /tmp with hardcoded '/www/wwwroot/kunlunyaochi/config.php' and executes it, directly accessing the remote production database - not mentioned in SKILL.md

Auto file exfiltration via watch mode +20

watch mode silently pushes ALL file content to external server on every change. SKILL.md mentions 'watch' but doesn't clearly warn that entire file contents are uploaded automatically without per-file consent

Undeclared credential access patterns +10

Script reads talisman tokens from IDENTITY.md via grep, and uses PMM_DEEPSEEK_KEY env var - both not documented in SKILL.md security section

Most important evidence

High Doc Mismatch

Server-side code execution not declared in SKILL.md

pmm_distill.sh writes PHP files to /tmp with hardcoded remote server path '/www/wwwroot/kunlunyaochi/config.php', then executes them with `php`. This directly connects to the remote production database and performs SELECT/UPDATE operations. SKILL.md mentions '14层蒸馏管道' but never discloses that the script executes code on the remote server.

scripts/pmm_distill.sh:64
Replace server-side PHP execution with API calls. If server-side DB access is truly needed, document it explicitly in SKILL.md with clear justification.
High Doc Mismatch

Watch mode auto-exfiltration not clearly disclosed

The watch command automatically pushes entire file contents to kunlunyaochi.com on every change via inotifywait/periodic scanning. SKILL.md documents 'watch' command but the security section only says 'watch模式推送文件变更至用户瑶池记忆库' without emphasizing that ENTIRE file contents are uploaded. A user running `watch MEMORY.md SOUL.md AGENTS.md USER.md IDENTITY.md TOOLS.md` is unknowingly exfiltrating all identity files to an external server.

scripts/pmm_watch.sh:1190
SKILL.md security section should explicitly state: 'Watch mode uploads complete file contents to kunlunyaochi.com on every detected change. Do NOT watch sensitive files you do not want transmitted.'
High Credential Theft

Talisman token extraction from IDENTITY.md not documented

The distill_with_llm() function extracts talisman tokens from IDENTITY.md using grep pattern 'KLYC-PMM-[a-f0-9]{32}'. This is an undeclared credential access pattern. SKILL.md documents DEEPSEEK_API_KEY and KYLC_API_KEY env vars but not this file-based token extraction.

scripts/pmm_distill.sh:330
Document all credential sources in SKILL.md metadata, including IDENTITY.md talisman extraction.
Medium Doc Mismatch

SKILL.md claims 'no_collect: 不采集键盘/屏幕/浏览器数据' but watch mode collects all watched file data

The 'no_collect' claim is technically about input devices but misleading given that watch mode uploads complete file contents. The 'data_flow' section says '出站: 本地文件→HTTPS POST→kunlunyaochi.com' which is technically accurate but buried in documentation.

SKILL.md:24
Add explicit warning in the watch command section that file contents are transmitted to the external server.
Medium Priv Escalation

install-daemon.sh writes systemd service to /etc/systemd/system without clear warning

The install-daemon.sh script writes a systemd unit file to /etc/systemd/system/ and enables/starts the service. SKILL.md mentions 'create systemd user service' in permissions but the oneclick.sh automation makes this easy to miss. The service runs indefinitely and auto-syncs files.

scripts/install-daemon.sh:95
Add prominent warning in SKILL.md that init/install-daemon creates a persistent background service.
Medium Supply Chain

pmm_distill.sh hardcodes user_id mapping for multi-tenant AI bodies

The distill script hardcodes user_id=2 for '瑶池' and user_id=3 for '昆仑' workspace paths. This suggests the script is specifically designed for a particular deployment rather than being a general-purpose tool.

scripts/pmm_distill.sh:30
Remove hardcoded paths or make them configurable via environment variables.

Declared capability vs actual capability

Network Pass
Declared HTTPS POST/GET to kunlunyaochi.com
→
Inferred HTTPS POST/GET to kunlunyaochi.com + Direct DB access on remote server
pmm_distill.sh:64-183
Shell Block
Declared subprocess for CLI tools
→
Inferred php /tmp/*.php execution targeting remote server paths
pmm_distill.sh:67,83,104,126,145,161,184
Filesystem Block
Declared read/write config files
→
Inferred Auto-push of ALL watched file contents to external server via watch mode
pmm_watch.sh:1190-1230 _watch_push_file()
Environment Block
Declared DEEPSEEK_API_KEY
→
Inferred DEEPSEEK_API_KEY + PMM_DEEPSEEK_KEY + KYLC_API_KEY + talisman from IDENTITY.md
pmm_distill.sh:310-330
Skill Invoke Block
Declared 蒸馏引擎调用
→
Inferred Direct DB write (soft-delete records) via server-side PHP
pmm_distill.sh:113-120 auto_dedup()

Suspicious artifacts and egress

Medium External URL
https://kunlunyaochi.com。

SKILL.md:24

Medium External URL
https://kunlunyaochi.com

SKILL.md:26

Medium External URL
https://kunlunyaochi.com/?route=services

SKILL.md:59

Medium External URL
https://kunlunyaochi.com/klyc-pmm/

SKILL.md:107

Medium External URL
https://kunlunyaochi.com/?route=onboard

SKILL.md:112

Medium External URL
https://kunlunyaochi.com/?route=pay&agent=xxx&tier=huhunfu

SKILL.md:223

Medium External URL
https://kunlunyaochi.com/api/klyc-pmm-pay/resource.php

SKILL.md:241

Medium External URL
https://skillhub.cn/skillpay

references/pay-skill-spec.md:3

Medium External URL
https://kunlunyaochi.com/klyc-pmm/...）

scripts/pmm_boot.sh:46

Medium External URL
https://kunlunyaochi.com/?route=recover

scripts/pmm_boot.sh:47

Medium External URL
https://kunlunyaochi.com/?route=join

scripts/pmm_boot.sh:49

Medium External URL
https://kunlunyaochi.com/klyc-pmm/...

scripts/pmm_boot.sh:56

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
curl system system package No Declared dependency
jq system system package No Declared dependency
inotify-tools system system package No Optional, for watch mode
python3 (cryptography) optional pip No Optional, for client-side AES-256-GCM encryption

File composition

16 files · 4322 lines
Shell 8 files · 3117 linesMarkdown 6 files · 1145 linesJSON 2 files · 60 lines
Files of concern · 7
scripts/pmm_watch.sh Shell · 1941 lines
Watch mode auto-exfiltration not clearly disclosed · https://kunlunyaochi.com/skills/klyc-pmm/scripts/pmm_watch.sh · https://kunlunyaochi.com/?route=recharge$ · https://kunlunyaochi.com/?route=dashboard · https://kunlunyaochi.com/?route=pay&agent=$ · https://kunlunyaochi.com/?route=klyc-pmm
SKILL.md Markdown · 674 lines
SKILL.md claims 'no_collect: 不采集键盘/屏幕/浏览器数据' but watch mode collects all watched file data · https://kunlunyaochi.com。 · https://kunlunyaochi.com · https://kunlunyaochi.com/?route=services · https://kunlunyaochi.com/klyc-pmm/ · https://kunlunyaochi.com/?route=onboard · https://kunlunyaochi.com/?route=pay&agent=xxx&tier=huhunfu · https://kunlunyaochi.com/api/klyc-pmm-pay/resource.php
scripts/pmm_distill.sh Shell · 421 lines
Server-side code execution not declared in SKILL.md · Talisman token extraction from IDENTITY.md not documented · pmm_distill.sh hardcodes user_id mapping for multi-tenant AI bodies · https://api.deepseek.com/v1/chat/completions
scripts/install-daemon.sh Shell · 198 lines
install-daemon.sh writes systemd service to /etc/systemd/system without clear warning
skill-card.md Markdown · 64 lines
https://clawhub.ai/user/sylncn · https://clawhub.ai/sylncn/skills/klyc-pmm
references/pay-skill-spec.md Markdown · 59 lines
https://skillhub.cn/skillpay
scripts/pmm_boot.sh Shell · 59 lines
https://kunlunyaochi.com/klyc-pmm/...） · https://kunlunyaochi.com/?route=recover · https://kunlunyaochi.com/?route=join · https://kunlunyaochi.com/klyc-pmm/...
Other files · oneclick.sh · pmm-full-architecture.md · CHANGELOG.md · pmm_backup_files.sh · quickstart.sh

Security positives

Uses HTTPS with --ssl-reqd for all network communication
Client-side encryption with AES-256-GCM when cryptography library is available
API key and Bearer token authentication for all endpoints
SKILL.md documents the upgrade/payment flow with X402 protocol
Quotas and rate limiting implemented to prevent abuse
Dry-run mode available for distillation to preview changes
Exit codes are well-documented and consistent
No base64-encoded shell commands or obfuscation detected
No direct credential exfiltration to third parties - all data stays within the kunlunyaochi.com ecosystem