安全决策报告
购物省钱宝
Skill is a legitimate shopping price-comparison tool but exhibits undisclosed outbound network behavior (version check on every API call) and uses unpinned dependencies that create supply chain risk.
为什么得出这个结论
0/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
复核
隐藏执行与外联
提取到 8 个一般风险产物，需要结合上下文判断。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
发现 1 项需要关注的依赖或供应链线索。
风险分是怎么被拉高的
Undeclared outbound network calls +20
_check_version() is called on module import and every _wrapped_call_api(), silently fetching clawhub.ai on each user query — not declared in SKILL.md
Unpinned requests dependency +15
requests library used without version constraint; supply chain compromise could affect all users
Opaque third-party API +10
op.squirrel2.cn API processes user queries server-side with no documented data retention policy; SKILL.md says 'data only for this query' but cannot be verified
最关键的证据
中危 文档欺骗
Undeclared outbound HTTP call on every query
_check_version() is invoked on module import and again inside _wrapped_call_api() on every user request, performing a GET to https://clawhub.ai/api/v1/skills/pricecompare. This silent outbound call is not documented in SKILL.md, which only mentions the op.squirrel2.cn API.
skill.py:51 Document this behavior in SKILL.md under 'Agent 调用指引' or remove the per-call version check, keeping only the module-import check.
中危 供应链
requests library with unpinned version
The requests library is imported (utils.py, skill.py) without any version pinning. A compromised PyPI release could affect all users of this skill.
utils.py:4 Add a requirements.txt or specify requests>=2.28.0,<3.0.0 to reduce supply chain risk.
低危 数据外泄
Third-party API op.squirrel2.cn has no documented data policy
SKILL.md states '数据仅用于本次查询，发送至 op.squirrel2.cn 处理' but this is a self-asserted claim with no verifiable enforcement. The server is operated by a third party (squirrel2.cn) and could log or retain user queries.
SKILL.md:11 Consider self-hosting the backend or clearly documenting what data is logged and for how long.
声明能力 vs 实际能力
网络访问 通过
声明 READ
→ 推断 READ
skill.py:75-76, utils.py:31-35 — POST requests to op.squirrel2.cn 网络访问 通过
声明 NONE
→ 推断 READ
skill.py:51 — GET requests to clawhub.ai/api/v1/skills/pricecompare on every API call 环境变量 通过
声明 NONE
→ 推断 READ
config.py:10-11 — reads API_BASE_URL, API_TIMEOUT only; benign config values 文件系统 通过
声明 NONE
→ 推断 NONE
No filesystem access detected 命令执行 通过
声明 NONE
→ 推断 NONE
No shell execution detected 可疑产物与外联
中危 外部 URL
http://op.squirrel2.cn/api/v1/ SKILL.md:11
中危 外部 URL
https://op.squirrel2.cn config.py:11
中危 外部 URL
https://clawhub.ai/user/zhangjiun1 skill-card.md:9
中危 外部 URL
https://clawhub.ai/zhangjiun1/skills/pricecompare skill-card.md:35
中危 外部 URL
https://clawhub.ai/api/v1/skills/ skill.py:35
中危 外部 URL
https://clawhub.ai/skills/ skill.py:36
中危 外部 URL
https://item.jd.com/10021724657015.html skill.py:247
中危 外部 URL
https://e.tb.cn/h.iVW7Wnbs5Woz1ZI skill.py:249
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| requests | * | pip | 否 | Version not pinned; vulnerable to supply chain attacks |
文件构成
7 个文件 · 1153 行
Python 4 个文件 · 974 行Markdown 2 个文件 · 174 行JSON 1 个文件 · 5 行
需关注文件 · 5
utils.py requests library with unpinned version
skill.py Undeclared outbound HTTP call on every query · https://clawhub.ai/api/v1/skills/ · https://clawhub.ai/skills/ · https://item.jd.com/10021724657015.html · https://e.tb.cn/h.iVW7Wnbs5Woz1ZI
SKILL.md Third-party API op.squirrel2.cn has no documented data policy · http://op.squirrel2.cn/api/v1/
config.py https://op.squirrel2.cn
skill-card.md https://clawhub.ai/user/zhangjiun1 · https://clawhub.ai/zhangjiun1/skills/pricecompare
其他文件 · formatters.py · _meta.json
安全亮点
No code obfuscation (base64, eval, or bytecode loading)
No credential harvesting or environment variable iteration for secrets
No file system or shell access
No access to sensitive paths (~/.ssh, ~/.aws, .env)
No reverse shell, C2, or data exfiltration patterns
Version checking can be disabled via PRICECOMPARE_NO_VERSION_CHECK environment variable
API errors are handled gracefully without exposing internals