安全决策报告
oia-skill
A legitimate project scaffolding tool with well-documented risks; the curl|sh for Deno and npx execution are declared but inherit standard supply-chain risk from third-party packages.
为什么得出这个结论
1/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
发现 1 项需要关注的依赖或供应链线索。
风险分是怎么被拉高的
curl|sh from official Deno source +10
Deno installation via deno.land/install.sh is standard practice but still executes arbitrary remote script — risk is documented in skill-card.md
Unpinned npx package execution +5
@oia-ai/oia-fresh@latest fetches and executes third-party npm code without version pinning
Minor: minor declaration gaps +5
SKILL.md documents shell and filesystem access but does not formally declare them as capabilities
最关键的证据
中危 供应链
Unpinned npx package execution
The skill uses 'npx -y @oia-ai/oia-fresh@latest init' which resolves to the latest version at execution time. This allows the published package to change content between executions, potentially introducing malicious code without a manifest change.
SKILL.md:35 Pin to a specific version tag (e.g., @1.2.3) and audit the package content before execution.
中危 代码执行
curl|sh remote script execution
The Deno installation command pipes a script downloaded from deno.land directly into sh. While deno.land is the official source, this pattern is inherently dangerous as it executes arbitrary remote code.
SKILL.md:24 Document this as a fallback only; recommend OS package managers (winget, brew, apt) or manual inspection of the script first.
低危 文档欺骗
Capability declarations not formally listed
SKILL.md describes the standard flow with concrete shell commands but does not include a formal 'allowed-tools' or 'declared-capabilities' section, making it harder to audit scope programmatically.
SKILL.md:1 Add a formal capabilities declaration at the top of SKILL.md for machine-readable auditing.
声明能力 vs 实际能力
命令执行 通过
声明 WRITE
→ 推断 WRITE
SKILL.md:21 — deno --version; SKILL.md:24 — curl|sh; SKILL.md:27 — npx --version; SKILL.md:35 — npx init; SKILL.md:47 — deno task dev 文件系统 通过
声明 WRITE
→ 推断 WRITE
SKILL.md:35 — scaffold writes to user-specified project directory; bin/install.js:27 — copies to .claude/skills/ 网络访问 通过
声明 READ
→ 推断 READ
SKILL.md:39,48 — polls http://127.0.0.1:5173; npm registry for npx fetches 可疑产物与外联
严重 危险命令
curl -fsSL https://deno.land/install.sh | sh SKILL.md:24
中危 外部 URL
https://deno.land/install.sh SKILL.md:24
中危 外部 URL
http://127.0.0.1: SKILL.md:39
中危 外部 URL
http://127.0.0.1:5173/ SKILL.md:48
中危 外部 URL
https://clawhub.ai/user/pankitgg skill-card.md:9
中危 外部 URL
https://clawhub.ai/pankitgg/skills/oia-skill skill-card.md:39
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| @oia-ai/oia-fresh | latest (unpinned) | npx | 否 | No version pin; resolves to latest at execution time — allows silent content changes |
| node:fs | stdlib | node | 否 | Used only for installing SKILL.md/REAMDE.md to .claude/skills/ |
| node:os | stdlib | node | 否 | Used only for homedir resolution in install script |
文件构成
6 个文件 · 209 行
Markdown 3 个文件 · 140 行JSON 2 个文件 · 36 行JavaScript 1 个文件 · 33 行
需关注文件 · 2
SKILL.md Unpinned npx package execution · curl|sh remote script execution · Capability declarations not formally listed · curl -fsSL https://deno.land/install.sh | sh · https://deno.land/install.sh · http://127.0.0.1: · http://127.0.0.1:5173/
skill-card.md https://clawhub.ai/user/pankitgg · https://clawhub.ai/pankitgg/skills/oia-skill
其他文件 · install.js · README.md · package.json · _meta.json
安全亮点
All high-risk behaviors are documented in skill-card.md under 'Known Risks and Mitigations'
No obfuscation, base64, or hidden execution paths detected
No credential harvesting, environment variable iteration, or sensitive file access
No external data exfiltration or C2 communication — network activity is limited to localhost verification and npm registry
install.js performs only expected file-copy operations using only Node.js stdlib (node:fs, node:os)
Documentation accurately describes all operations performed by the skill
HTTP verification poll targets only localhost, not external IPs