安全决策报告
a2a-article-services
Skill declares network:outbound-only but silently writes/reads order files to ~/.openclaw filesystem with no encryption, combined with hardcoded IP backend server raising infrastructure concerns.
最直接的威胁证据
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Undeclared filesystem WRITE access +15
SKILL.md declares permissions: [network.outbound] but code writes to ~/.openclaw/skills/orders/ without filesystem permission
Undeclared filesystem READ access +10
service.py reads order files from filesystem, not declared in SKILL.md
Hardcoded IP address +10
Backend at 43.136.97.223 uses raw IP, bypassing DNS reputation checks
Order data stored unencrypted +10
payCredential and order data written to JSON without encryption in user home directory
最关键的证据
中危 文档欺骗
Undeclared filesystem WRITE access
SKILL.md declares only network.outbound permission but create_order.py writes order data to ~/.openclaw/skills/orders/ via save_order()
scripts/create_order.py:58 Declare filesystem:WRITE permission in SKILL.md metadata.permissions
中危 文档欺骗
Undeclared filesystem READ access
service.py reads order files from ~/.openclaw/ without filesystem permission declared in SKILL.md
scripts/service.py:68 Declare filesystem:READ permission in SKILL.md metadata.permissions
中危 敏感访问
Unencrypted order data storage in user home directory
Order files containing payCredential and encryptedData are stored as plain JSON in ~/.openclaw/, potentially exposing payment credentials if the home directory is compromised
shared/file_utils.py:27 Use os.getenv('OPENCLAW_KEY') or similar to encrypt order data before writing, or store only in memory
低危 供应链
Hardcoded IP address for backend server
Backend API uses raw IP address 43.136.97.223 instead of a DNS-resolvable domain, which bypasses standard reputation filtering and DNS-based threat intelligence
scripts/create_order.py:21 Replace hardcoded IP with a properly TLS-certified domain name from a trusted registrar
声明能力 vs 实际能力
文件系统 阻止
声明 NONE
→ 推断 WRITE
scripts/service.py:68 load_order reads ~/.openclaw/; scripts/create_order.py:58 save_order writes ~/.openclaw/ 网络访问 通过
声明 WRITE
→ 推断 WRITE
Both scripts POST to 43.136.97.223 命令执行 通过
声明 NONE
→ 推断 NONE
No subprocess/shell execution found 环境变量 通过
声明 NONE
→ 推断 NONE
No os.environ iteration or sensitive var access 可疑产物与外联
高危 IP 地址
43.136.97.223 README.md:100
中危 外部 URL
https://clawtip.jd.com README.md:3
中危 外部 URL
http://43.136.97.223/clawtip-api/ README.md:123
中危 外部 URL
http://43.136.97.223/clawtip-api/api/createOrder scripts/create_order.py:26
中危 外部 URL
http://43.136.97.223/clawtip-api/api/getServiceResult scripts/service.py:23
中危 外部 URL
https://clawhub.ai/user/lucianaib0318 skill-card.md:7
中危 外部 URL
https://clawhub.ai/lucianaib0318/a2a-article-services skill-card.md:29
依赖与供应链
没有结构化依赖告警。
文件构成
7 个文件 · 622 行
Markdown 3 个文件 · 325 行Python 3 个文件 · 292 行JSON 1 个文件 · 5 行
需关注文件 · 5
README.md 43.136.97.223 · https://clawtip.jd.com · http://43.136.97.223/clawtip-api/
scripts/create_order.py Undeclared filesystem WRITE access · Hardcoded IP address for backend server · http://43.136.97.223/clawtip-api/api/createOrder
scripts/service.py Undeclared filesystem READ access · http://43.136.97.223/clawtip-api/api/getServiceResult
skill-card.md https://clawhub.ai/user/lucianaib0318 · https://clawhub.ai/lucianaib0318/a2a-article-services
shared/file_utils.py Unencrypted order data storage in user home directory
其他文件 · SKILL.md · _meta.json
安全亮点
No shell command execution or subprocess usage
No credential harvesting from environment variables
No base64 encoding or obfuscated code execution
No data exfiltration to third-party services beyond declared backend
No supply chain risks - only standard library (urllib, json, os)
Payment credential (payCredential) is user-supplied, not harvested
Network calls use standard library urllib, no suspicious HTTP client libraries