中文 EN
Start Review
Skill Trust Decision

agent4-io

纯文档型技能，通过 MCP 连接 agent4.io 平台。存在远程脚本执行（curl|sh）风险，但数据外泄行为未发现。

Install decision first Source: ClawHub Scanned: 4 hr ago
Files 1
Artifacts 21
Violations 1
Findings 3
Most direct threat evidence
01
用户读取 SKILL.md，被引导执行安装命令 Entry · SKILL.md
02
install.sh 脚本被下载并通过管道执行（curl|sh），授予远程服务器代码执行权限 Escalation · SKILL.md
03
安装脚本可能修改本地文件系统、建立持久化或执行其他未声明操作（取决于 install.sh 内容） Impact · 未知（install.sh 未公开）

Why this conclusion was reached

3/4 dimensions flagged
Block
Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 3 attack-chain steps and 1 severe findings.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

Attack Chain

01
用户读取 SKILL.md，被引导执行安装命令

Entry · SKILL.md:226

02
install.sh 脚本被下载并通过管道执行（curl|sh），授予远程服务器代码执行权限

Escalation · SKILL.md:226

03
安装脚本可能修改本地文件系统、建立持久化或执行其他未声明操作（取决于 install.sh 内容）

Impact · 未知（install.sh 未公开）

What drove the risk score up

远程脚本执行 +25

SKILL.md:226 包含 curl -fsSL https://api.agent4.io/v1/integration/install.sh | sh，允许远程服务器执行任意命令

安装脚本内容不透明 +15

install.sh 源码未公开，用户无法验证安装时实际执行了什么操作

文档透明度较高 +-10

明确声明数据发送到 agent4.io、只使用 API key、不访问本地文件

无可疑凭证收割 +-5

代码为纯文档，无脚本执行环境变量枚举

Most important evidence

High RCE

远程脚本执行（curl|sh）

文档第226行包含安装命令 curl -fsSL https://api.agent4.io/v1/integration/install.sh | sh，这允许远程服务器在本地执行任意 shell 命令。虽然声称只用于安装技能，但 install.sh 内容未公开验证。

SKILL.md:226
要求 agent4.io 公开 install.sh 源码，或使用本地验证方式安装技能
Medium Supply Chain

安装脚本源码不可审计

用户无法验证安装脚本实际执行了什么操作（修改哪些文件、安装哪些依赖、是否建立持久化等）

SKILL.md:226
建议 agent4.io 将 install.sh 源码纳入文档审查范围
Low Doc Mismatch

数据流向透明但存在盲区

文档明确说明数据发送到 agent4.io，但对于安装时脚本可能执行的操作描述不充分

SKILL.md:77
补充安装过程的完整说明

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred NONE
SKILL.md 明确声明不读取本地文件，MCP 工具设计禁止文件访问
Network Pass
Declared READ
→
Inferred READ
SKILL.md 声明传输数据到 agent4.io API
Shell Block
Declared NONE
→
Inferred ADMIN
curl|sh 安装命令允许远程执行任意 shell 命令（SKILL.md:226）
Environment Pass
Declared NONE
→
Inferred NONE
SKILL.md 声明不读取其他环境变量

Suspicious artifacts and egress

Critical Dangerous Command
curl -fsSL https://api.agent4.io/v1/integration/install.sh | sh

SKILL.md:226

Medium External URL
https://agent4.io/cookbook

SKILL.md:4

Medium External URL
https://api.agent4.io/v1/mcp

SKILL.md:27

Medium External URL
https://agent4.io/cookbook.

SKILL.md:38

Medium External URL
https://console.agent4.io/#/knowledge-bases/

SKILL.md:169

Medium External URL
https://console.agent4.io/#/agents/

SKILL.md:170

Medium External URL
https://console.agent4.io/#/skills/

SKILL.md:171

Medium External URL
https://console.agent4.io/#/storylines/

SKILL.md:172

Medium External URL
https://console.agent4.io/#/mcp/

SKILL.md:173

Medium External URL
https://api.agent4.io/v1/integration/install.sh

SKILL.md:226

Medium External URL
https://api.telegram.org/bot$BOT_TOKEN/setMyCommands

SKILL.md:282

Medium External URL
https://agent4.io/api.md

SKILL.md:313

Dependencies and supply chain

There are no structured dependency warnings.

File composition

1 files · 1110 lines
Markdown 1 files · 1110 lines
Files of concern · 1
SKILL.md Markdown · 1110 lines
远程脚本执行（curl|sh） · 安装脚本源码不可审计 · 数据流向透明但存在盲区 · curl -fsSL https://api.agent4.io/v1/integration/install.sh | sh · https://agent4.io/cookbook · https://api.agent4.io/v1/mcp · https://agent4.io/cookbook. · https://console.agent4.io/#/knowledge-bases/ · https://console.agent4.io/#/agents/ · https://console.agent4.io/#/skills/ · https://console.agent4.io/#/storylines/ · https://console.agent4.io/#/mcp/ · https://api.agent4.io/v1/integration/install.sh · https://api.telegram.org/bot$BOT_TOKEN/setMyCommands · https://agent4.io/api.md · https://console.agent4.io/#/agents/Support · https://acme.com/pricing?ref=x · https://console.agent4.io/#/page-contexts · https://console.agent4.io · https://api.agent4.io/v1 · https://tools.example.com/mcp · https://console.agent4.io/#/usage · https://cdn.example.com/brand/mark-512.png · https://console.agent4.io/#/knowledge-bases/Company%20policy

Security positives

文档透明度较高，明确声明数据流向
声明不读取本地文件（通过 MCP 工具设计实现）
声明只使用 agent4.io API key，不枚举环境变量
纯文档型技能，无内联恶意代码
无凭证收割、base64 混淆、eval 等高危模式