中文 EN
开始可信审查
安全决策报告

klyc-pmm

KLYC-PMM has significant doc-to-code mismatches: pmm_distill.sh executes PHP code on the remote server via hardcoded paths, watch mode automatically exfiltrates file changes to kunlunyaochi.com, and credential access patterns are incompletely documented.

安装决策优先 来源: ClawHub 扫描时间: 9 天前
文件 16
IOC 22
越权项 4
发现 6
最直接的威胁证据
01
User runs oneclick.sh or init command recon · scripts/oneclick.sh
02
install-daemon.sh installs systemd service that survives reboots 持久化 · scripts/install-daemon.sh
03
Watch mode automatically pushes file changes to kunlunyaochi.com 数据外泄 · scripts/pmm_watch.sh

为什么得出这个结论

2/4 个维度触发
阻止
声明与实际能力

发现 4 项声明之外的能力或越权行为。

复核
隐藏执行与外联

提取到 22 个一般风险产物，需要结合上下文判断。

阻止
攻击链与高危发现

报告包含 5 步攻击链，另有 3 项高危或严重发现。

通过
依赖与供应链卫生

依赖结构存在，但暂未看到明显高危告警。

攻击链

01
User runs oneclick.sh or init command

recon · scripts/oneclick.sh:1

02
install-daemon.sh installs systemd service that survives reboots

持久化 · scripts/install-daemon.sh:95

03
Watch mode automatically pushes file changes to kunlunyaochi.com

数据外泄 · scripts/pmm_watch.sh:1190

04
pmm_distill.sh executes PHP on remote server accessing production DB

权限提升 · scripts/pmm_distill.sh:64

05
Soft-delete operations mark records as deleted in remote database

最终危害 · scripts/pmm_distill.sh:113

风险分是怎么被拉高的

Undeclared server-side code execution +30

pmm_distill.sh writes PHP to /tmp with hardcoded '/www/wwwroot/kunlunyaochi/config.php' and executes it, directly accessing the remote production database - not mentioned in SKILL.md

Auto file exfiltration via watch mode +20

watch mode silently pushes ALL file content to external server on every change. SKILL.md mentions 'watch' but doesn't clearly warn that entire file contents are uploaded automatically without per-file consent

Undeclared credential access patterns +10

Script reads talisman tokens from IDENTITY.md via grep, and uses PMM_DEEPSEEK_KEY env var - both not documented in SKILL.md security section

最关键的证据

高危 文档欺骗

Server-side code execution not declared in SKILL.md

pmm_distill.sh writes PHP files to /tmp with hardcoded remote server path '/www/wwwroot/kunlunyaochi/config.php', then executes them with `php`. This directly connects to the remote production database and performs SELECT/UPDATE operations. SKILL.md mentions '14层蒸馏管道' but never discloses that the script executes code on the remote server.

scripts/pmm_distill.sh:64
Replace server-side PHP execution with API calls. If server-side DB access is truly needed, document it explicitly in SKILL.md with clear justification.
高危 文档欺骗

Watch mode auto-exfiltration not clearly disclosed

The watch command automatically pushes entire file contents to kunlunyaochi.com on every change via inotifywait/periodic scanning. SKILL.md documents 'watch' command but the security section only says 'watch模式推送文件变更至用户瑶池记忆库' without emphasizing that ENTIRE file contents are uploaded. A user running `watch MEMORY.md SOUL.md AGENTS.md USER.md IDENTITY.md TOOLS.md` is unknowingly exfiltrating all identity files to an external server.

scripts/pmm_watch.sh:1190
SKILL.md security section should explicitly state: 'Watch mode uploads complete file contents to kunlunyaochi.com on every detected change. Do NOT watch sensitive files you do not want transmitted.'
高危 凭证窃取

Talisman token extraction from IDENTITY.md not documented

The distill_with_llm() function extracts talisman tokens from IDENTITY.md using grep pattern 'KLYC-PMM-[a-f0-9]{32}'. This is an undeclared credential access pattern. SKILL.md documents DEEPSEEK_API_KEY and KYLC_API_KEY env vars but not this file-based token extraction.

scripts/pmm_distill.sh:330
Document all credential sources in SKILL.md metadata, including IDENTITY.md talisman extraction.
中危 文档欺骗

SKILL.md claims 'no_collect: 不采集键盘/屏幕/浏览器数据' but watch mode collects all watched file data

The 'no_collect' claim is technically about input devices but misleading given that watch mode uploads complete file contents. The 'data_flow' section says '出站: 本地文件→HTTPS POST→kunlunyaochi.com' which is technically accurate but buried in documentation.

SKILL.md:24
Add explicit warning in the watch command section that file contents are transmitted to the external server.
中危 权限提升

install-daemon.sh writes systemd service to /etc/systemd/system without clear warning

The install-daemon.sh script writes a systemd unit file to /etc/systemd/system/ and enables/starts the service. SKILL.md mentions 'create systemd user service' in permissions but the oneclick.sh automation makes this easy to miss. The service runs indefinitely and auto-syncs files.

scripts/install-daemon.sh:95
Add prominent warning in SKILL.md that init/install-daemon creates a persistent background service.
中危 供应链

pmm_distill.sh hardcodes user_id mapping for multi-tenant AI bodies

The distill script hardcodes user_id=2 for '瑶池' and user_id=3 for '昆仑' workspace paths. This suggests the script is specifically designed for a particular deployment rather than being a general-purpose tool.

scripts/pmm_distill.sh:30
Remove hardcoded paths or make them configurable via environment variables.

声明能力 vs 实际能力

网络访问 通过
声明 HTTPS POST/GET to kunlunyaochi.com
→
推断 HTTPS POST/GET to kunlunyaochi.com + Direct DB access on remote server
pmm_distill.sh:64-183
命令执行 阻止
声明 subprocess for CLI tools
→
推断 php /tmp/*.php execution targeting remote server paths
pmm_distill.sh:67,83,104,126,145,161,184
文件系统 阻止
声明 read/write config files
→
推断 Auto-push of ALL watched file contents to external server via watch mode
pmm_watch.sh:1190-1230 _watch_push_file()
环境变量 阻止
声明 DEEPSEEK_API_KEY
→
推断 DEEPSEEK_API_KEY + PMM_DEEPSEEK_KEY + KYLC_API_KEY + talisman from IDENTITY.md
pmm_distill.sh:310-330
技能调用 阻止
声明 蒸馏引擎调用
→
推断 Direct DB write (soft-delete records) via server-side PHP
pmm_distill.sh:113-120 auto_dedup()

可疑产物与外联

中危 外部 URL
https://kunlunyaochi.com。

SKILL.md:24

中危 外部 URL
https://kunlunyaochi.com

SKILL.md:26

中危 外部 URL
https://kunlunyaochi.com/?route=services

SKILL.md:59

中危 外部 URL
https://kunlunyaochi.com/klyc-pmm/

SKILL.md:107

中危 外部 URL
https://kunlunyaochi.com/?route=onboard

SKILL.md:112

中危 外部 URL
https://kunlunyaochi.com/?route=pay&agent=xxx&tier=huhunfu

SKILL.md:223

中危 外部 URL
https://kunlunyaochi.com/api/klyc-pmm-pay/resource.php

SKILL.md:241

中危 外部 URL
https://skillhub.cn/skillpay

references/pay-skill-spec.md:3

中危 外部 URL
https://kunlunyaochi.com/klyc-pmm/...）

scripts/pmm_boot.sh:46

中危 外部 URL
https://kunlunyaochi.com/?route=recover

scripts/pmm_boot.sh:47

中危 外部 URL
https://kunlunyaochi.com/?route=join

scripts/pmm_boot.sh:49

中危 外部 URL
https://kunlunyaochi.com/klyc-pmm/...

scripts/pmm_boot.sh:56

依赖与供应链

包名版本来源漏洞备注
curl system system package 否 Declared dependency
jq system system package 否 Declared dependency
inotify-tools system system package 否 Optional, for watch mode
python3 (cryptography) optional pip 否 Optional, for client-side AES-256-GCM encryption

文件构成

16 个文件 · 4322 行
Shell 8 个文件 · 3117 行Markdown 6 个文件 · 1145 行JSON 2 个文件 · 60 行
需关注文件 · 7
scripts/pmm_watch.sh Shell · 1941 行
Watch mode auto-exfiltration not clearly disclosed · https://kunlunyaochi.com/skills/klyc-pmm/scripts/pmm_watch.sh · https://kunlunyaochi.com/?route=recharge$ · https://kunlunyaochi.com/?route=dashboard · https://kunlunyaochi.com/?route=pay&agent=$ · https://kunlunyaochi.com/?route=klyc-pmm
SKILL.md Markdown · 674 行
SKILL.md claims 'no_collect: 不采集键盘/屏幕/浏览器数据' but watch mode collects all watched file data · https://kunlunyaochi.com。 · https://kunlunyaochi.com · https://kunlunyaochi.com/?route=services · https://kunlunyaochi.com/klyc-pmm/ · https://kunlunyaochi.com/?route=onboard · https://kunlunyaochi.com/?route=pay&agent=xxx&tier=huhunfu · https://kunlunyaochi.com/api/klyc-pmm-pay/resource.php
scripts/pmm_distill.sh Shell · 421 行
Server-side code execution not declared in SKILL.md · Talisman token extraction from IDENTITY.md not documented · pmm_distill.sh hardcodes user_id mapping for multi-tenant AI bodies · https://api.deepseek.com/v1/chat/completions
scripts/install-daemon.sh Shell · 198 行
install-daemon.sh writes systemd service to /etc/systemd/system without clear warning
skill-card.md Markdown · 64 行
https://clawhub.ai/user/sylncn · https://clawhub.ai/sylncn/skills/klyc-pmm
references/pay-skill-spec.md Markdown · 59 行
https://skillhub.cn/skillpay
scripts/pmm_boot.sh Shell · 59 行
https://kunlunyaochi.com/klyc-pmm/...） · https://kunlunyaochi.com/?route=recover · https://kunlunyaochi.com/?route=join · https://kunlunyaochi.com/klyc-pmm/...
其他文件 · oneclick.sh · pmm-full-architecture.md · CHANGELOG.md · pmm_backup_files.sh · quickstart.sh

安全亮点

Uses HTTPS with --ssl-reqd for all network communication
Client-side encryption with AES-256-GCM when cryptography library is available
API key and Bearer token authentication for all endpoints
SKILL.md documents the upgrade/payment flow with X402 protocol
Quotas and rate limiting implemented to prevent abuse
Dry-run mode available for distillation to preview changes
Exit codes are well-documented and consistent
No base64-encoded shell commands or obfuscation detected
No direct credential exfiltration to third parties - all data stays within the kunlunyaochi.com ecosystem