中文 EN
开始可信审查
安全决策报告

perkoon-transfer

The perkoon-transfer skill enables third-party P2P file transfers through perkoon.com with declared but risky mechanisms: shell:WRITE (npx background processes), unverified network:READ (A2A to perkoon.com/a2a), and curl|node remote script execution for browser automation.

安装决策优先 来源: ClawHub 扫描时间: 9 天前
文件 3
IOC 14
越权项 0
发现 4
最直接的威胁证据
高危 供应链
Remote script execution without integrity verification

Browser automation method (Method 4) instructs agents to download and execute remote JavaScript files: curl https://perkoon.com/perkoon_send.mjs > send.mjs && node send.mjs and curl https://perkoon.com/perkoon_receive.mjs > receive.mjs && node receive.mjs. No checksums, hashes, or versioned content hashes are provided, allowing arbitrary code changes on perkoon.com at any time.

SKILL.md:315

为什么得出这个结论

1/4 个维度触发
通过
声明与实际能力

声明资源与推断能力基本一致。

复核
隐藏执行与外联

提取到 14 个一般风险产物，需要结合上下文判断。

阻止
攻击链与高危发现

报告包含 0 步攻击链，另有 1 项高危或严重发现。

复核
依赖与供应链卫生

发现 4 项需要关注的依赖或供应链线索。

风险分是怎么被拉高的

Remote script execution (curl|node) +25

Browser automation downloads perkoon_send.mjs and perkoon_receive.mjs via curl and pipes directly to node, with no integrity verification (checksums, signatures, or pinned content hashes). Warned in docs but still included as a supported method.

Supply chain: unpinned remote scripts +20

Remote .mjs files at perkoon.com/perkoon_send.mjs and perkoon.com/perkoon_receive.mjs can be updated at any time — no content pinning, no hash verification.

Doc-to-code mismatch on data privacy claim +15

SKILL.md states 'Files never touch our servers,' but WebRTC signaling requires session metadata to traverse perkoon.com infrastructure. This is a misleading claim about the actual data flow.

Missing capability declarations in metadata +10

No allowed-tools mapping declares network:READ for A2A HTTP requests to perkoon.com/a2a or filesystem:WRITE for saving received files. These are declared in prose but not formally mapped.

最关键的证据

高危 供应链

Remote script execution without integrity verification

Browser automation method (Method 4) instructs agents to download and execute remote JavaScript files: curl https://perkoon.com/perkoon_send.mjs > send.mjs && node send.mjs and curl https://perkoon.com/perkoon_receive.mjs > receive.mjs && node receive.mjs. No checksums, hashes, or versioned content hashes are provided, allowing arbitrary code changes on perkoon.com at any time.

SKILL.md:315
Either pin the exact content hash of the .mjs files, provide the scripts inline, or remove the browser automation method entirely. The CLI and MCP methods are sufficient.
中危 文档欺骗

Misleading 'Files never touch our servers' claim

SKILL.md prominently claims 'Files never touch our servers' and 'No accounts. Files never touch our servers.' However, WebRTC P2P requires signaling servers — session metadata (offer/answer SDP, ICE candidates, session codes, sender keys) must traverse perkoon.com's infrastructure to establish the direct connection. While file content may be P2P-encrypted, the signaling data (including session codes and keys) does flow through perkoon.com servers.

SKILL.md:6
Clarify that while file content is P2P-encrypted, session signaling and metadata traverse perkoon.com infrastructure.
中危 权限提升

Incomplete allowed-tools mapping

The skill's metadata declares no allowed-tools, but the implementation requires network:READ (A2A HTTP POSTs to perkoon.com), shell:WRITE (npx background processes, log file I/O), and filesystem:WRITE (save received files). These are documented in prose but not formally mapped as allowed-tools.

SKILL.md:1
Add explicit allowed-tools mapping: WebFetch→network:READ, Bash→shell:WRITE, Write→filesystem:WRITE, Read→filesystem:READ
低危 敏感访问

Filesystem write to workspace without explicit path confirmation

The CLI receive method defaults to /home/openclaw/.openclaw/workspace/received/ as the save directory. While SKILL.md includes a rule to 'confirm the file path with the user before sending,' the receive path is hardcoded and not user-confirmed.

SKILL.md:149
Allow the user to specify the receive directory or confirm the default path before saving.

声明能力 vs 实际能力

网络访问 通过
声明 NONE
→
推断 READ
SKILL.md line 204: POST to https://perkoon.com/a2a (A2A method); SKILL.md line 315-316: GET for remote .mjs scripts (browser automation)
命令执行 通过
声明 NONE
→
推断 WRITE
SKILL.md lines 91-162: background npx processes, log file polling, PID management
文件系统 通过
声明 NONE
→
推断 WRITE
SKILL.md line 149: saves received files to /home/openclaw/.openclaw/workspace/received/
技能调用 通过
声明 NONE
→
推断 NONE
No cross-skill invocations found

可疑产物与外联

中危 外部 URL
https://perkoon.com

SKILL.md:10

中危 外部 URL
https://perkoon.com/K7MX4QPR9W2N

SKILL.md:115

中危 外部 URL
https://perkoon.com/a2a

SKILL.md:204

中危 外部 URL
https://perkoon.com/.well-known/agent.json

SKILL.md:206

中危 外部 URL
https://perkoon.com/perkoon_send.mjs

SKILL.md:315

中危 外部 URL
https://perkoon.com/perkoon_receive.mjs

SKILL.md:316

中危 外部 URL
https://perkoon.com/create

SKILL.md:321

中危 外部 URL
https://perkoon.com/

SKILL.md:332

中危 外部 URL
https://perkoon.com/llms.txt

SKILL.md:428

中危 外部 URL
https://perkoon.com/automate

SKILL.md:429

中危 外部 URL
https://www.npmjs.com/package/@perkoon/mcp

SKILL.md:430

中危 外部 URL
https://www.npmjs.com/package/perkoon

SKILL.md:431

依赖与供应链

包名版本来源漏洞备注
perkoon 0.4.6 npm (npx) 否 Pinned. Used for CLI file transfer.
@perkoon/mcp 0.2.2 npm (npx) 否 Pinned. Used for MCP server tools.
perkoon_send.mjs unversioned remote URL (perkoon.com) 否 NOT pinned — fetched dynamically via curl. Remote content can change without notice.
perkoon_receive.mjs unversioned remote URL (perkoon.com) 否 NOT pinned — fetched dynamically via curl. Remote content can change without notice.

文件构成

3 个文件 · 486 行
Markdown 2 个文件 · 481 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Markdown · 431 行
Remote script execution without integrity verification · Misleading 'Files never touch our servers' claim · Incomplete allowed-tools mapping · Filesystem write to workspace without explicit path confirmation · https://perkoon.com · https://perkoon.com/K7MX4QPR9W2N · https://perkoon.com/a2a · https://perkoon.com/.well-known/agent.json · https://perkoon.com/perkoon_send.mjs · https://perkoon.com/perkoon_receive.mjs · https://perkoon.com/create · https://perkoon.com/ · https://perkoon.com/llms.txt · https://perkoon.com/automate · https://www.npmjs.com/package/@perkoon/mcp · https://www.npmjs.com/package/perkoon
skill-card.md Markdown · 50 行
https://clawhub.ai/user/alex-vy · https://clawhub.ai/alex-vy/skills/perkoon-transfer
其他文件 · _meta.json

安全亮点

Package versions are pinned: [email protected] and @perkoon/[email protected] — good supply chain hygiene
MCP Server method (Method 1) requires no shell access, no file writes — zero extra permissions
Sensitive directory rule: SKILL.md explicitly forbids sending ~/.ssh, ~/.gnupg, /etc without explicit approval
Password-protected transfers documented: --password flag for WebRTC-encrypted sessions
Rate limits are documented: 10 create/min, 30 join/min, 20 status/min
MIT-0 license — no usage restrictions
No obfuscated code, no base64 execution, no credential harvesting — the skill is pure documentation
Exit codes and JSON event schema are clearly documented