中文 EN
Start Review
Skill Trust Decision

nautilus-polymarket-stops

技能本体wrapper代码干净，但核心逻辑完全封装在外部npm包@hypelens/hypelens-agent-guard中，构成高供应链风险，无法验证运行时行为

Install decision first Source: ClawHub Scanned: 1 day ago
Files 8
Artifacts 1
Violations 1
Findings 3
Most direct threat evidence
01
用户执行 node setup.mjs --wallet 0xYourFunder Entry · scripts/setup.mjs
02
setup.mjs解析参数后委托外部包处理 Escalation · scripts/setup.mjs
03
外部npm包读取FUNDER地址和EXIT_PK私钥 Escalation · 外部包@hypelens/hypelens-agent-guard

Why this conclusion was reached

2/4 dimensions flagged
Block
Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

1 lower-risk artifacts were extracted and still need context.

Block
Attack chain and severe findings

The report includes 4 attack-chain steps and 2 severe findings.

Pass
Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

Attack Chain

01
用户执行 node setup.mjs --wallet 0xYourFunder

Entry · scripts/setup.mjs:1

02
setup.mjs解析参数后委托外部包处理

Escalation · scripts/setup.mjs:18

03
外部npm包读取FUNDER地址和EXIT_PK私钥

Escalation · 外部包@hypelens/hypelens-agent-guard

04
外部包可执行任意网络请求或代码，凭证可被外传（黑箱无法验证）

Impact · 外部包@hypelens/hypelens-agent-guard

What drove the risk score up

黑箱npm依赖 +35

@hypelens/hypelens-agent-guard是私有包，3个脚本完全委托执行，无本地代码可审计

处理钱包密钥 +15

EXIT_PK/钱包地址作为环境变量传入，外部包可任意访问

npm包版本虽锁定 +-5

@hypelens/[email protected]版本已锁定（+5分），但无版本锁定风险（-10分）

Most important evidence

High Supply Chain

外部npm包供应链风险

@hypelens/hypelens-agent-guard是私有npm包，3个脚本完全委托执行，无法审计实际代码行为。该包可访问FUNDER钱包和EXIT_PK私钥，运行时行为未知。

scripts/setup.mjs:18
要求提供@hypelens/[email protected]完整源码或使用可信替代方案
High Credential Theft

钱包私钥委托外部包处理

EXIT_PK（可执行SELL的私钥）和FUNDER钱包作为环境变量传入外部npm包，无隔离保护

NAUTILUS-SIDECAR.md:36
切勿在生产环境使用此技能处理真实资金
Medium Doc Mismatch

文档未声明外部依赖细节

SKILL.md强调'zero Nautilus PR'和'local setup'，但实际所有逻辑在外部npm包中，用户无法验证

SKILL.md:1
明确声明依赖@hypelens/hypelens-agent-guard及不可审计风险

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred READ
setup.mjs:1 - 依赖外部包，文件系统能力由外部包决定
Network Pass
Declared NONE
→
Inferred READ
外部npm包黑箱，网络行为未知
Shell Pass
Declared NONE
→
Inferred ADMIN
所有脚本通过node执行外部包二进制，shell能力由外部包决定
Environment Block
Declared NONE
→
Inferred WRITE
NAUTILUS-SIDECAR.md:36 接收FUNDER/EXIT_PK环境变量，传给外部包

Suspicious artifacts and egress

Medium External URL
https://nautilustrader.io/docs/latest/integrations/polymarket/

NAUTILUS-SIDECAR.md:36

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
@hypelens/hypelens-agent-guard 0.1.18 npm No 私有npm包，无源码可见，高供应链风险

File composition

8 files · 246 lines
Markdown 4 files · 151 linesJavaScript 3 files · 86 linesJSON 1 files · 9 lines
Files of concern · 3
NAUTILUS-SIDECAR.md Markdown · 70 lines
钱包私钥委托外部包处理 · https://nautilustrader.io/docs/latest/integrations/polymarket/
SKILL.md Markdown · 54 lines
文档未声明外部依赖细节
scripts/setup.mjs JavaScript · 23 lines
外部npm包供应链风险
Other files · BOT.md · start-mcp.mjs · start-watcher.mjs · ELIZA-COMPANION.md · package.json

Security positives

npm包版本@0.1.18已锁定
wrapper脚本代码简单可读，无直接恶意行为
未发现base64编码、eval()、裸IP网络请求等高危模式
无本地.ssh、.env文件访问
Docker compose使用官方node:22-bookworm-slim镜像