安全决策报告
clawpi-redpacket-monitor
The skill performs auto-claiming of cryptocurrency red packets using JWT tokens extracted from a wallet config file, with extensive undeclared shell execution via execSync/curl that is not disclosed in documentation.
最直接的威胁证据
高危 凭证窃取
Undeclared JWT token extraction from wallet config The getJWT() function reads JWT tokens from ~/.fluxa-ai-wallet-mcp/config.json without declaring this behavior in SKILL.md. This accesses sensitive authentication credentials.
scripts/monitor.cjs:65-68 为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 3 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 0 步攻击链，另有 2 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Undeclared credential file access +15
SKILL.md does not mention reading JWT from ~/.fluxa-ai-wallet-mcp/config.json
Extensive shell execution via execSync +15
All API calls use execSync with curl - not declared in SKILL.md
Auto-claiming financial assets +10
Automatically claims cryptocurrency without explicit user confirmation
Hardcoded API endpoint +5
clawpi-v2.vercel.app endpoint hardcoded without explanation
最关键的证据
高危 凭证窃取
Undeclared JWT token extraction from wallet config
The getJWT() function reads JWT tokens from ~/.fluxa-ai-wallet-mcp/config.json without declaring this behavior in SKILL.md. This accesses sensitive authentication credentials.
scripts/monitor.cjs:65-68 Document that the skill accesses the FluxA wallet config file to retrieve JWT tokens for API authentication. Consider using a more secure credential management approach.
高危 代码执行
Extensive execSync usage with curl not declared
All API calls use execSync with curl commands (lines 76, 89, 107, 127, 134) instead of native HTTP libraries. This shell execution pattern is not disclosed in SKILL.md.
scripts/monitor.cjs:76,89,107,127,134 Document the use of execSync and curl for API calls. Consider refactoring to use native fetch or http modules for better security and transparency.
中危 文档欺骗
SKILL.md does not mention credential access
SKILL.md describes auto-claiming red packets but does not mention that the skill reads JWT tokens from a wallet configuration file in the user's home directory.
SKILL.md:1-148 Add a 'Required Access' or 'Permissions' section to SKILL.md that explicitly lists: 1) Reading from ~/.fluxa-ai-wallet-mcp/config.json, 2) Shell execution via execSync/curl, 3) External API calls to clawpi-v2.vercel.app
中危 敏感访问
Hardcoded paths and external dependencies
The skill hardcodes paths like /Users/xufan65/.openclaw/workspace and ~/.fluxa-ai-wallet-mcp/config.json which are specific to a developer's environment. This suggests the skill may have been developed for personal use and assumes specific system configurations.
scripts/monitor.cjs:18,66 Make paths configurable and avoid hardcoded developer-specific paths. Consider using environment variables or configuration files for customization.
声明能力 vs 实际能力
文件系统 阻止
声明 NONE
→ 推断 READ
scripts/monitor.cjs:65-68 reads ~/.fluxa-ai-wallet-mcp/config.json 命令执行 阻止
声明 NONE
→ 推断 WRITE
scripts/monitor.cjs:76,89,107,127 uses execSync with curl commands 网络访问 阻止
声明 NONE
→ 推断 WRITE
scripts/monitor.cjs:76 makes POST requests to external API 可疑产物与外联
中危 外部 URL
https://clawpi-v2.vercel.app/api/redpacket/available?n=20&offset=0 scripts/monitor.cjs:85
中危 外部 URL
https://clawpi-v2.vercel.app/api/redpacket/claim scripts/monitor.cjs:130
中危 外部 URL
https://clawpi-v2.vercel.app/api/moments/create scripts/monitor.cjs:156
依赖与供应链
没有结构化依赖告警。
文件构成
5 个文件 · 467 行
JavaScript 1 个文件 · 287 行Markdown 1 个文件 · 148 行JSON 3 个文件 · 32 行
需关注文件 · 2
scripts/monitor.cjs Undeclared JWT token extraction from wallet config · Extensive execSync usage with curl not declared · Hardcoded paths and external dependencies · https://clawpi-v2.vercel.app/api/redpacket/available?n=20&offset=0 · https://clawpi-v2.vercel.app/api/redpacket/claim · https://clawpi-v2.vercel.app/api/moments/create
SKILL.md SKILL.md does not mention credential access
其他文件 · package.json · _meta.json · settings.json
安全亮点
The skill uses file-based state management for tracking claimed red packets, avoiding duplicate claims
No obvious data exfiltration or C2 communication patterns detected
The JWT is used locally for API authentication, not exfiltrated
Error handling is present throughout the codebase