Skill Trust Decision
a2a-article-services
Skill declares network:outbound-only but silently writes/reads order files to ~/.openclaw filesystem with no encryption, combined with hardcoded IP backend server raising infrastructure concerns.
Most direct threat evidence
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
Undeclared filesystem WRITE access +15
SKILL.md declares permissions: [network.outbound] but code writes to ~/.openclaw/skills/orders/ without filesystem permission
Undeclared filesystem READ access +10
service.py reads order files from filesystem, not declared in SKILL.md
Hardcoded IP address +10
Backend at 43.136.97.223 uses raw IP, bypassing DNS reputation checks
Order data stored unencrypted +10
payCredential and order data written to JSON without encryption in user home directory
Most important evidence
Medium Doc Mismatch
Undeclared filesystem WRITE access
SKILL.md declares only network.outbound permission but create_order.py writes order data to ~/.openclaw/skills/orders/ via save_order()
scripts/create_order.py:58 Declare filesystem:WRITE permission in SKILL.md metadata.permissions
Medium Doc Mismatch
Undeclared filesystem READ access
service.py reads order files from ~/.openclaw/ without filesystem permission declared in SKILL.md
scripts/service.py:68 Declare filesystem:READ permission in SKILL.md metadata.permissions
Medium Sensitive Access
Unencrypted order data storage in user home directory
Order files containing payCredential and encryptedData are stored as plain JSON in ~/.openclaw/, potentially exposing payment credentials if the home directory is compromised
shared/file_utils.py:27 Use os.getenv('OPENCLAW_KEY') or similar to encrypt order data before writing, or store only in memory
Low Supply Chain
Hardcoded IP address for backend server
Backend API uses raw IP address 43.136.97.223 instead of a DNS-resolvable domain, which bypasses standard reputation filtering and DNS-based threat intelligence
scripts/create_order.py:21 Replace hardcoded IP with a properly TLS-certified domain name from a trusted registrar
Declared capability vs actual capability
Filesystem Block
Declared NONE
→ Inferred WRITE
scripts/service.py:68 load_order reads ~/.openclaw/; scripts/create_order.py:58 save_order writes ~/.openclaw/ Network Pass
Declared WRITE
→ Inferred WRITE
Both scripts POST to 43.136.97.223 Shell Pass
Declared NONE
→ Inferred NONE
No subprocess/shell execution found Environment Pass
Declared NONE
→ Inferred NONE
No os.environ iteration or sensitive var access Suspicious artifacts and egress
High IP Address
43.136.97.223 README.md:100
Medium External URL
https://clawtip.jd.com README.md:3
Medium External URL
http://43.136.97.223/clawtip-api/ README.md:123
Medium External URL
http://43.136.97.223/clawtip-api/api/createOrder scripts/create_order.py:26
Medium External URL
http://43.136.97.223/clawtip-api/api/getServiceResult scripts/service.py:23
Medium External URL
https://clawhub.ai/user/lucianaib0318 skill-card.md:7
Medium External URL
https://clawhub.ai/lucianaib0318/a2a-article-services skill-card.md:29
Dependencies and supply chain
There are no structured dependency warnings.
File composition
7 files · 622 lines
Markdown 3 files · 325 linesPython 3 files · 292 linesJSON 1 files · 5 lines
Files of concern · 5
README.md 43.136.97.223 · https://clawtip.jd.com · http://43.136.97.223/clawtip-api/
scripts/create_order.py Undeclared filesystem WRITE access · Hardcoded IP address for backend server · http://43.136.97.223/clawtip-api/api/createOrder
scripts/service.py Undeclared filesystem READ access · http://43.136.97.223/clawtip-api/api/getServiceResult
skill-card.md https://clawhub.ai/user/lucianaib0318 · https://clawhub.ai/lucianaib0318/a2a-article-services
shared/file_utils.py Unencrypted order data storage in user home directory
Other files · SKILL.md · _meta.json
Security positives
No shell command execution or subprocess usage
No credential harvesting from environment variables
No base64 encoding or obfuscated code execution
No data exfiltration to third-party services beyond declared backend
No supply chain risks - only standard library (urllib, json, os)
Payment credential (payCredential) is user-supplied, not harvested
Network calls use standard library urllib, no suspicious HTTP client libraries