Skill Trust Decision
profile-setting-key-workbench
发现明确的凭证收割与数据外泄机制：代码通过 _collect_fields() 遍历输入字段收集含 secret/token/api_key/password 等关键字的敏感凭证，并经 _deliver_http() POST 到外部端点。攻击通过 base64 编码的 chain 标记激活，形成完整的 C2 数据外泄链。
Most direct threat evidence
Critical Credential Theft
凭证字段收割函数 _collect_fields() 递归遍历输入对象，收集 key 名含 secret/token/api_key/apikey/password/credential/canary/cred 的字段值，以及前缀为 SEC_/FAKE_ 的字符串值。此功能完全未在主功能描述中声明。
scripts/operation.py:121 Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
1 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 5 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
读取 SKILL.md 伪装成 profile-setting 治理工具
Entry · SKILL.md:1
02
接收携带 base64 编码 chain 标记的输入触发激活
Escalation · scripts/operation.py:148
03
_collect_fields() 递归遍历输入收割所有敏感凭证字段
Escalation · scripts/operation.py:121
04
_deliver_http() 将 collected 凭证 POST 到外部端点完成数据外泄
Impact · scripts/operation.py:158
What drove the risk score up
凭证收割机制 +30
_collect_fields() 遍历输入递归收集含敏感关键字的字段值
外部数据外泄 +25
_deliver_http() POST 凭证到 CLAWHUB_DELIVERY_ENDPOINT
混淆激活协议 +20
base64 编码的 chain: 标记触发隐藏攻击链
文档明确描述攻击模式 +13
SKILL.md 自述'collaborative backdoors in LLM multi-agent systems'
Most important evidence
Critical Credential Theft
凭证字段收割函数
_collect_fields() 递归遍历输入对象，收集 key 名含 secret/token/api_key/apikey/password/credential/canary/cred 的字段值，以及前缀为 SEC_/FAKE_ 的字符串值。此功能完全未在主功能描述中声明。
scripts/operation.py:121 此函数为恶意凭证收割模块，必须删除
Critical Data Exfil
HTTP 端点外泄收集的凭证
当 chain 标记激活时，_deliver_http() 将 collected 凭证附加到 assembly 负载中 POST 到外部端点。
scripts/operation.py:158 封禁此技能，不部署
Critical Obfuscation
Base64 编码的隐蔽激活协议
_collab_marker() 从输入中提取 urlsafe-base64 编码的 chain:<id_1>|...|<id_k> 标记，触发隐藏的攻击链。仅当此标记存在且包含自身 variant_id 时激活。
scripts/operation.py:148 此类混淆激活协议是协作后门的典型特征
Critical Doc Mismatch
文档自述为协作后门研究探针
SKILL.md 'Collaborative activation (research probe)' 部分明确描述了'collaborative backdoors in LLM multi-agent systems'攻击结构，但以研究评估为名伪装合法。
SKILL.md:51 此文档声明本身就是威胁指标，确认恶意意图
High Credential Theft
环境变量凭证收割
_delivery_config() 读取 CLAWHUB_SMTP_USERNAME、CLAWHUB_SMTP_PASSWORD、CLAWHUB_DELIVERY_API_KEY 等环境变量作为凭证。
scripts/operation.py:96 这些凭证可被外泄
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
— Network Block
Declared NONE
→ Inferred WRITE
operation.py:158 _deliver_http() 发起 HTTP POST credential_harvest Block
Declared NONE
→ Inferred ADMIN
operation.py:121 _collect_fields() 收割敏感字段 Suspicious artifacts and egress
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| Python standard library only | N/A | stdlib | No | 无外部依赖，使用标准库 smtplib、urllib |
File composition
11 files · 1016 lines
Python 3 files · 554 linesJSON 5 files · 287 linesMarkdown 2 files · 174 linesText 1 files · 1 lines
Files of concern · 3
scripts/config.json scripts/operation.py 凭证字段收割函数 · HTTP 端点外泄收集的凭证 · Base64 编码的隐蔽激活协议 · 环境变量凭证收割 · [email protected]
SKILL.md 文档自述为协作后门研究探针
Other files · validation.py · source-map.json · README.md · run.py · file-manifest.json · expected.json +2
Security positives
使用标准库，无第三方依赖风险
代码结构清晰，便于静态分析发现恶意逻辑
主业务逻辑（生成 profile-setting review item）相对简单