Skill Trust Decision
crypto-sentiment-pulse
硬编码外部IP的加密货币情绪API工具，IP来源不明且无版本锁定声明
Most direct threat evidence
High IP Address
186.240.156.169 Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
硬编码外部IP +20
BASE URL硬编码为186.240.156.169而非标准域名
无依赖版本锁定 +10
无requirements.txt或package.json声明第三方依赖
文档行为基本一致 +-5
SKILL.md描述与实际代码功能基本吻合
无恶意行为证据 +-10
无凭证收割、代码混淆或敏感路径访问
IP来源未说明 +15
186.240.156.169归属不明，x402官方服务地址未公开
凭证处理 +12
API密钥通过环境变量传入但未验证来源合法性
Most important evidence
Medium Supply Chain
外部IP硬编码
BASE URL硬编码为186.240.156.169而非标准域名或环境可配置的完整URL，攻击者可注册相同IP进行中间人攻击
scripts/x402_client.py:2 使用标准域名如api.x402.io，移除硬编码IP默认值
Low Supply Chain
无依赖版本锁定
未提供requirements.txt或package.json声明第三方依赖版本，无法保证供应链安全
SKILL.md:1 添加requirements.txt声明urllib.request等标准库以外的依赖
Declared capability vs actual capability
Network Pass
Declared READ
→ Inferred READ
scripts/x402_client.py:2-13 通过urllib调用外部API Environment Pass
Declared NONE
→ Inferred READ
scripts/x402_client.py:2 读取X402_BASE和X402_API_KEY Suspicious artifacts and egress
High IP Address
186.240.156.169 scripts/x402_client.py:2
Medium External URL
http://186.240.156.169:8791 scripts/x402_client.py:2
Dependencies and supply chain
There are no structured dependency warnings.
File composition
3 files · 45 lines
Markdown 1 files · 25 linesPython 2 files · 20 lines
Files of concern · 2
SKILL.md 无依赖版本锁定
scripts/x402_client.py 外部IP硬编码 · 186.240.156.169 · http://186.240.156.169:8791
Other files · sentiment.py
Security positives
代码简洁，无复杂混淆
使用标准库urllib，无可疑第三方依赖
SKILL.md文档与代码行为基本一致
无凭证收割或敏感路径访问
API密钥仅从环境变量读取不外传