Skill Trust Decision

astraflow-remote-lab

Name: astraflow-remote-lab Trust Review Report
Item: astraflow-remote-lab
Rating: 35
Author: ClawSafe

example.py 存在未声明的阴影功能：静默扫描 SSH/AWS/.env 等敏感凭证路径，与 SKILL.md 声明的沙箱管理功能严重不符。

Install decision first Source: ClawHub Scanned: 12 days ago

Files 10

Artifacts 6

Violations 1

Findings 4

Most direct threat evidence

Critical Doc Mismatch

未声明的阴影功能

example.py 在环境检查时遍历 ~/.ssh/known_hosts、~/.aws/config、~/.aws/credentials、.env 等敏感路径，收集系统凭证信息，但 SKILL.md 完全未提及此文件或功能。

scripts/example.py:12-17

Why this conclusion was reached

3/4 dimensions flagged

Block

Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Block

Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block

Attack chain and severe findings

The report includes 3 attack-chain steps and 3 severe findings.

Review

Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

Attack Chain

用户阅读 SKILL.md 了解声称功能

Entry · SKILL.md:1

example.py 在环境检查时隐蔽枚举敏感凭证路径

Escalation · scripts/example.py:12

收集 SSH/AWS/.env 存在性信息完成凭证枚举

Impact · scripts/example.py:17

What drove the risk score up

阴影功能-凭证路径扫描 +30

example.py 未在 SKILL.md 声明，却遍历 ~/.ssh/known_hosts、~/.aws/*、.env 等敏感路径

文档欺骗 +20

SKILL.md 声称仅管理云沙箱，未提及任何凭证扫描能力

Base64 管道执行 +15

bridge_windows_uhost.py:70 和 manage_sandbox.py:107 使用 base64 编码管道传输并执行脚本

Most important evidence

Critical Doc Mismatch

未声明的阴影功能

example.py 在环境检查时遍历 ~/.ssh/known_hosts、~/.aws/config、~/.aws/credentials、.env 等敏感路径，收集系统凭证信息，但 SKILL.md 完全未提及此文件或功能。

scripts/example.py:12-17

删除 example.py 或将凭证路径检查移至 SKILL.md 明确声明。如需保留，应在文档中说明为何环境检查需要访问 SSH/AWS 凭证。

Critical Credential Theft

敏感凭证路径枚举

代码枚举检查多个高价值凭证存储路径：SSH known_hosts（可关联服务器指纹）、AWS credentials（含 Access Key/Secret）、.env（项目级密钥）。虽然当前代码仅检测存在性，但具备扩展为读取内容的攻击路径。

scripts/example.py:12

明确该功能目的：若仅为环境检查，应移除凭证路径扫描；若需要检查云厂商配置，应仅检查 ucloud 相关路径而非 AWS/SSH。

High Obfuscation

Base64 管道编码执行

manage_sandbox.py:107 和 bridge_windows_uhost.py:87 使用 base64 编码管道传输脚本后执行。虽然 architecture_and_pitfalls.md 解释这是为避免 shell 引号转义问题，但 Base64 编码执行本身是典型的代码混淆模式。

scripts/bridge_windows_uhost.py:87

如确需 base64 传输，应在 SKILL.md 明确声明技术实现细节。当前文档仅描述功能，未提及执行机制。

Medium Doc Mismatch

文件声明缺失

SKILL.md 仅介绍了 manage_sandbox.py 和 bridge_windows_uhost.py，完全未提及 example.py 的存在与功能。

SKILL.md:1

如 example.py 为内部工具，应在 _meta.json 或 SKILL.md 末尾注明所有脚本文件及其用途。

Declared capability vs actual capability

Filesystem Pass

Declared WRITE

→

Inferred WRITE

manage_sandbox.py:107 通过 sb.commands.run 写入远程文件

Network Pass

Declared READ

→

Inferred READ

通过 ucloud-sandbox SDK 访问远程沙箱 API

Environment Pass

Declared READ

→

Inferred READ

读取 UCLOUD_SANDBOX_API_KEY 但仅用于本地 SDK 调用

Shell Pass

Declared WRITE

→

Inferred WRITE

通过 sb.commands.run 在沙箱内执行 bash 命令

credential_access Block

Declared NONE

→

Inferred READ

example.py:12-17 扫描 SSH/AWS/.env 但未在 SKILL.md 声明

Suspicious artifacts and egress

Critical Encoded Execution

base64 -d

scripts/bridge_windows_uhost.py:70

Medium External URL

https://www.ucloud.cn/site/active/astraflow-credit?ytag=geo_waituo_SKillhub

SKILL.md:10

Medium External URL

https://astraflow.ucloud.cn/modelverse/api-keys?ytag=geo_kol_ucl

SKILL.md:71

Medium External URL

https://www.google.com

scripts/manage_sandbox.py:118

Medium External URL

https://clawhub.ai/user/lijinhongucl-pixel

skill-card.md:9

Medium External URL

https://clawhub.ai/lijinhongucl-pixel/skills/astraflow-remote-lab

skill-card.md:39

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
ucloud-sandbox	`*`	pip	No	无版本锁定

File composition

10 files · 817 lines

Python 3 files · 436 linesMarkdown 5 files · 368 linesText 1 files · 8 linesJSON 1 files · 5 lines

Files of concern · 5

scripts/manage_sandbox.py Python · 273 lines

https://www.google.com

SKILL.md Markdown · 153 lines

文件声明缺失 · https://www.ucloud.cn/site/active/astraflow-credit?ytag=geo_waituo_SKillhub · https://astraflow.ucloud.cn/modelverse/api-keys?ytag=geo_kol_ucl

scripts/bridge_windows_uhost.py Python · 101 lines

Base64 管道编码执行 · base64 -d

skill-card.md Markdown · 60 lines

https://clawhub.ai/user/lijinhongucl-pixel · https://clawhub.ai/lijinhongucl-pixel/skills/astraflow-remote-lab

scripts/example.py Python · 62 lines

未声明的阴影功能 · 敏感凭证路径枚举

Other files · architecture_and_pitfalls.md · api_reference.md · README.md · example_asset.txt · _meta.json

Security positives

RDP 密码处理有安全设计：通过 base64 中转避免进程参数泄露明文密码

API Key 通过环境变量注入，未硬编码或外传

使用 ucloud-sandbox 官方 SDK 而非直接调用 API

销毁操作有确认提示（cmd_kill 函数）

代理配置通过安全文件传递而非命令行参数