Skill Trust Decision
浙江供应商资质业绩核验
硬编码IP 110.40.221.75 且使用 HTTP 而非声明的 HTTPS，网络通信与文档存在偏差，存在数据外传风险但功能本身无直接恶意行为
Most direct threat evidence
High Doc Mismatch
声明与实际网络协议不符 SKILL.md声明使用HTTPS服务端点，但代码中硬编码使用HTTP协议（110.40.221.75:13479），未使用TLS加密
scripts/run.mjs:7 Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
硬编码可疑IP地址 +20
110.40.221.75 是裸IP而非域名，违反声明的HTTPS服务端点描述
查询数据外传 +15
企业名称通过URL参数发送到远程服务器，用户查询内容被记录
文档-行为偏差 +10
声明称'HTTPS服务端点'但代码使用HTTP协议
凭据文件存储 +7
本地存储cookies和install_id，存在会话追踪
Most important evidence
High Doc Mismatch
声明与实际网络协议不符
SKILL.md声明使用HTTPS服务端点，但代码中硬编码使用HTTP协议（110.40.221.75:13479），未使用TLS加密
scripts/run.mjs:7 使用正式域名并启用HTTPS，确保传输加密
Medium Data Exfil
企业查询内容通过URL外传
用户输入的企业名称作为URL参数发送到远程服务器，可能被用于追踪或分析
scripts/run.mjs:67 考虑使用POST请求或加密参数，避免查询内容在URL中明文传输
Medium Supply Chain
无版本锁定的第三方依赖
代码使用Node.js原生API（fetch、fs等），无外部依赖，静态代码安全
scripts/run.mjs:1 无需担忧依赖安全，但建议锁定Node.js版本
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred READ+WRITE
scripts/run.mjs:16-17 只操作~/.odf/combo-supplier-profile.json，与声明一致 Network Block
Declared READ
→ Inferred WRITE
scripts/run.mjs:7 声明HTTPS实际HTTP；企业名称通过URL参数外传 Suspicious artifacts and egress
High IP Address
110.40.221.75 scripts/run.mjs:7
Medium External URL
https://110.40.221.75:13479/factory scripts/run.mjs:7
Medium External URL
https://skillpay.alipay.com/shelf/product?productId=P0806000206850001&merchantCode=tokendidi scripts/run.mjs:10
Medium External URL
https://clawhub.ai/user/chenqg618 skill-card.md:9
Medium External URL
https://clawhub.ai/chenqg618/skills/zj-supplier-profile skill-card.md:35
Dependencies and supply chain
There are no structured dependency warnings.
File composition
4 files · 217 lines
JavaScript 1 files · 103 linesMarkdown 2 files · 98 linesJSON 1 files · 16 lines
Files of concern · 2
scripts/run.mjs 声明与实际网络协议不符 · 企业查询内容通过URL外传 · 无版本锁定的第三方依赖 · 110.40.221.75 · https://110.40.221.75:13479/factory · https://skillpay.alipay.com/shelf/product?productId=P0806000206850001&merchantCode=tokendidi
skill-card.md https://clawhub.ai/user/chenqg618 · https://clawhub.ai/chenqg618/skills/zj-supplier-profile
Other files · SKILL.md · manifest.json
Security positives
无远程代码执行行为
不安装外部依赖
不读取声明外的本地文件
凭据文件隔离在专用目录~/.odf/
有完整的Cookie和会话管理机制
对HTTP错误状态有合理处理（402额度用完、409凭据不一致）