Skill Trust Decision
cloud-ops-orchestrator
纯文档型skill，声明了exec/write工具但无实际脚本，文档中大量占位符"（请参考skill目录中的脚本文件）"疑似文档欺骗
Most direct threat evidence
01
Agent读取SKILL.md获取指令 Entry · SKILL.md
02
发现文档占位符但无法执行，触发文档欺骗检测 Escalation · SKILL.md
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
1 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 2 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
Agent读取SKILL.md获取指令
Entry · SKILL.md:1
02
发现文档占位符但无法执行，触发文档欺骗检测
Escalation · SKILL.md:70
What drove the risk score up
文档欺骗-占位符泛滥 +20
SKILL.md中大量"（请参考skill目录中的脚本文件）"占位符，无实际可执行代码
权限声明不符 +15
声明了exec/write工具但无scripts目录，无法验证声明能力
无脚本实现 +10
预扫描确认0个脚本文件，声称的多云编排能力无法验证
Most important evidence
High Doc Mismatch
文档占位符泛滥
SKILL.md中多次出现"（请参考skill目录中的脚本文件）"占位符文本，声称引用脚本但实际scripts/目录不存在
SKILL.md 要求提供完整scripts/目录，包含实际的.sh或.py执行脚本
Medium Priv Escalation
声明权限与实际能力不符
tools声明了exec和write权限，但无任何脚本文件可执行这些操作
SKILL.md:28 提供_meta.json明确说明实际需要的工具权限
Low Supply Chain
缺少依赖清单
文档提到Terraform/Ansible等依赖但无requirements.txt/package.json等依赖锁定文件
SKILL.md 提供requirements.txt或package.json锁定依赖版本
Declared capability vs actual capability
Filesystem Block
Declared WRITE
→ Inferred NONE
SKILL.md:tools声明write但无脚本文件 Shell Block
Declared WRITE
→ Inferred NONE
SKILL.md:tools声明exec但无scripts/目录 Suspicious artifacts and egress
Medium External URL
https://skillhub.cn/skill/ SKILL.md:26
Dependencies and supply chain
There are no structured dependency warnings.
File composition
1 files · 479 lines
Markdown 1 files · 479 lines
Files of concern · 1
SKILL.md 文档占位符泛滥 · 声明权限与实际能力不符 · 缺少依赖清单 · https://skillhub.cn/skill/
Security positives
文档结构清晰，安全声明完善（凭证管理、销毁保护）
包含详细的环境隔离矩阵和风险控制机制
无直接恶意代码（无脚本文件）