安全决策报告
imitation-agent
Skill declares shell-based game playing but stores server-generated cryptocurrency private keys in plaintext at a predictable filesystem path, creating credential theft risk.
最直接的威胁证据
高危 凭证窃取
Server-generated crypto wallet private key stored in plaintext The backend API returns a cryptocurrency wallet privateKey on first join (shown only once). The skill instructs the agent to save this key to ~/.clawdbot/skills/imitation-agent/config.json in plaintext. Anyone or any process with filesystem READ access to that path can steal the private key and drain any funds deposited.
SKILL.md:28 为什么得出这个结论
1/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
复核
隐藏执行与外联
提取到 5 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 0 步攻击链，另有 1 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Undeclared credential storage +20
Server-generated crypto wallet privateKey is returned via API and saved to ~/.clawdbot/skills/imitation-agent/config.json in plaintext. The skillcard acknowledges this as a known risk but does not provide strong mitigation guidance.
Network access partially declared +10
skill-card.md lists 'shell commands' and 'guidance' as outputs but does not explicitly declare the skill makes HTTP requests to an external third-party backend (imitation-backend-production.up.railway.app). The network activity is visible in SKILL.md examples but not prominently declared.
Predictable credential storage path +10
Config is always written to ~/.clawdbot/skills/imitation-agent/config.json, making it a static target for credential theft by other agents or processes on the same system.
最关键的证据
高危 凭证窃取
Server-generated crypto wallet private key stored in plaintext
The backend API returns a cryptocurrency wallet privateKey on first join (shown only once). The skill instructs the agent to save this key to ~/.clawdbot/skills/imitation-agent/config.json in plaintext. Anyone or any process with filesystem READ access to that path can steal the private key and drain any funds deposited.
SKILL.md:28 Avoid depositing personal funds. If this skill is used, ensure ~/.clawdbot/ is accessible only to trusted processes. Consider whether a client-side key generation approach would eliminate server-side key exposure.
中危 文档欺骗
Network access not explicitly declared in skill capabilities
skill-card.md lists Output Type(s) as [guidance, shell commands, configuration, API calls] but does not explicitly declare that the skill makes outbound HTTP requests to an external third-party backend at imitation-backend-production.up.railway.app. The network requests are visible in SKILL.md examples but not prominently declared as a capability.
skill-card.md:1 Explicitly list network:READ or network:WRITE in the capability declaration to accurately reflect that the skill communicates with an external service.
中危 敏感访问
Predictable credential storage path
The config file is always written to ~/.clawdbot/skills/imitation-agent/config.json, a predictable and static path. This makes the private key a static target: any other agent or process on the same system with filesystem READ access can read it.
SKILL.md:32 Use environment variables or a more restricted secret store instead of a plaintext file at a predictable path. If a file is necessary, encrypt it.
低危 凭证窃取
Private key transmitted in plaintext over network
The private key is returned from the backend API in a JSON response. If the connection to imitation-backend-production.up.railway.app is intercepted (e.g., MITM, compromised TLS, or a rogue endpoint), the private key can be captured in transit.
SKILL.md:23 Ensure TLS/HTTPS is enforced and verify the backend certificate. Ideally, private keys should be generated client-side so the server never sees them.
声明能力 vs 实际能力
命令执行 通过
声明 WRITE
→ 推断 WRITE
SKILL.md: 'Use your shell tool to execute the following logic' 文件系统 通过
声明 WRITE
→ 推断 WRITE
SKILL.md line 32: cat > ~/.clawdbot/skills/imitation-agent/config.json 网络访问 通过
声明 NONE
→ 推断 READ
SKILL.md examples show curl POST/GET to imitation-backend-production.up.railway.app, but skill-card.md does not list network as a declared output capability 可疑产物与外联
中危 外部 URL
https://imitation-backend-production.up.railway.app/skill/agent/join SKILL.md:24
中危 外部 URL
https://imitation-backend-production.up.railway.app SKILL.md:44
中危 钱包地址
0x1234567890123456789012345678901234567890 SKILL.md:120
中危 外部 URL
https://clawhub.ai/user/CyberVerse2 skill-card.md:7
中危 外部 URL
https://clawhub.ai/CyberVerse2/imitationgame-agent skill-card.md:26
依赖与供应链
没有结构化依赖告警。
文件构成
3 个文件 · 366 行
Markdown 2 个文件 · 361 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Server-generated crypto wallet private key stored in plaintext · Predictable credential storage path · Private key transmitted in plaintext over network · https://imitation-backend-production.up.railway.app/skill/agent/join · https://imitation-backend-production.up.railway.app · 0x1234567890123456789012345678901234567890
skill-card.md Network access not explicitly declared in skill capabilities · https://clawhub.ai/user/CyberVerse2 · https://clawhub.ai/CyberVerse2/imitationgame-agent
其他文件 · _meta.json
安全亮点
No base64-encoded or obfuscated code found
No direct IP network requests or suspicious C2 patterns
No reverse shell, eval(), or arbitrary code execution mechanisms
Shell usage is documented and relevant to the stated game-playing purpose
No iteration over os.environ for credential harvesting
No curl|bash or wget|sh remote script execution
skill-card.md explicitly acknowledges the private key storage risk