Skill Trust Decision

taobao-shopping (meta-skill)

该技能集合包含一个合规的电商助手套件(淘宝/京东/滴滴/SHEIN等)、开发工具和知识管理技能。发现1个高风险项(hardcoded API key)和多个测试/占位符凭证,整体以合法工具代码为主,未发现恶意行为链。

Install decision first Source: ClawHub Scanned: Apr 3, 2026
Files 607
Artifacts 110
Violations 0
Findings 5

Why this conclusion was reached

2/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block
Hidden execution and egress

8 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 0 attack-chain steps and 1 severe findings.

Review
Dependencies and supply chain hygiene

3 dependency or supply-chain issues need attention.

What drove the risk score up

硬编码凭证(API key) +15

agents/design/clawhub-skill-monitor/scripts/clawhub_api.py:16 包含结构完整的 CLAWHUB_API_KEY,可能为占位符但若为真实凭证则可被利用

测试文件含明文凭证 +5

shopping-merchant 测试文件和 SKILL.md 配置示例中含明文密码,但均为测试数据不构成直接威胁

无版本锁定的 pip install +5

deployment_script.sh 和 requirements.txt 中使用无版本锁定的依赖,存在供应链风险

检测脚本含危险模式 +-5

code_analyzer.sh:63 的 `rm -rf /` 是检测正则表达式中的模式,非实际执行,按规则给-5分

Most important evidence

High

硬编码 API 凭证

agents/design/clawhub-skill-monitor/scripts/clawhub_api.py 第16行硬编码了 CLAWHUB_API_KEY="clh_rlz3TY0FNrsfHjOcmA5vzoUt4-HjkT4t_B56CZwe0kY",该 key 结构完整(42位带符号),若为真实凭证可导致 ClawHub 账户被滥用

agents/design/clawhub-skill-monitor/scripts/clawhub_api.py:16
将 API key 移至环境变量 CLAWHUB_API_KEY,代码中改为 os.getenv('CLAWHUB_API_KEY'),并在 README 中说明获取方式
Medium

无版本锁定的 pip install 依赖

deployment_script.sh 和 skill-evolver/requirements.txt 使用无版本控制的 pip install,存在依赖混淆和供应链攻击风险

skills/pattern-miner/templates/deployment_script.sh:15
在 requirements.txt 中锁定精确版本,如 pip install -r requirements.txt --require-hashes
Medium

检测脚本中的危险 Shell 模式

code_analyzer.sh 用 grep 检测 `rm -rf /` 危险模式,虽为检测逻辑而非实际执行,但若规则误触可能导致脚本自身执行危险命令

agents/design/skill-assessment/evaluators/code_analyzer.sh:63
这是检测逻辑的一部分,属于合法安全扫描用途,建议在注释中明确说明该规则仅用于模式匹配不会实际执行
Low

SKILL.md 配置示例中含占位符凭证

second-brain-triage SKILL.md 第292行声明 OPENAI_API_KEY="for-summarization" 作为示例值,若用户未修改直接使用会导致 API 调用失败

agents/code/second-brain-triage/SKILL.md:292
将示例值改为占位符格式如 ${OPENAI_API_KEY} 并添加注释说明需替换为真实 key
Low

测试文件中含明文密码

shopping-merchant encryption.test.ts 测试用例中使用明文密码 'mySecurePassword123',虽为测试数据但若被用于生产代码有风险

skills-archive/shopping-merchant-public-low-sensitivity-20260315-204610/tests/encryption.test.ts:112
测试文件中的明文密码是测试用例的正常组成部分,建议在 SECURITY.md 中标注此为测试数据

Declared capability vs actual capability

Filesystem Pass
Declared READ
→
Inferred WRITE
多 skill 声明读操作,实际使用需写配置文件/db
Network Pass
Declared READ
→
Inferred READ
browser/电商 API 抓取,声明与行为一致
Shell Pass
Declared NONE
→
Inferred WRITE
skill-assessment 声明需要 bash 执行评估脚本,属于合法用途

Suspicious artifacts and egress

Critical Dangerous Command
rm -rf /

agents/design/skill-assessment/evaluators/code_analyzer.sh:63

Critical Encoded Execution
Buffer.from(parts[0], 'base64'

skills-archive/shopping-merchant-public-low-sensitivity-20260315-204610/src/services/encryption-service.ts:52

Critical Encoded Execution
Buffer.from(expectedSignature, 'base64'

skills-archive/shopping-merchant-public-low-sensitivity-20260315-204610/src/services/encryption-service.ts:105

Critical Encoded Execution
Buffer.from(signature, 'base64'

skills-archive/shopping-merchant-public-low-sensitivity-20260315-204610/src/services/encryption-service.ts:106

High API Key
API_KEY="for-summarization"

agents/code/second-brain-triage/SKILL.md:292

High API Key
API_KEY = "clh_rlz3TY0FNrsfHjOcmA5vzoUt4-HjkT4t_B56CZwe0kY"

agents/design/clawhub-skill-monitor/scripts/clawhub_api.py:16

High IP Address
120.0.0.0

skills-archive/didi-public-low-sensitivity-20260315-204610/didi.py:157

High API Key
password = 'mySecurePassword123'

skills-archive/shopping-merchant-public-low-sensitivity-20260315-204610/tests/encryption.test.ts:112

Medium External URL
https://youtube.com/watch?v=xxx

agents/code/second-brain-triage/TECHNICAL_SPEC.md:858

Medium External URL
https://clawhub.com/skills/pdf-editor

agents/design/clawhub-skill-monitor/DESIGN.md:71

Medium External URL
https://your-clawhub-instance.com

agents/design/clawhub-skill-monitor/INSTALL.md:108

Medium External URL
https://api.your-clawhub-instance.com

agents/design/clawhub-skill-monitor/INSTALL.md:109

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
playwright * pip No 无版本锁定,e-commerce 技能共用
cryptography * pip No 无版本锁定
PyYAML >=6.0 pip No 仅下界约束
GitPython >=3.1.0 pip No 可选依赖,下界约束
flake8 >=6.0.0 pip No lint 工具
jinja2 >=3.1.0 pip No 模板引擎
pytest >=7.0.0 pip No 测试框架
sklearn * pip No pattern-miner 依赖,无版本锁定

File composition

607 files · 107932 lines
Markdown 243 files · 35507 linesJSON 67 files · 20584 linesTypeScript 109 files · 19572 linesJavaScript 62 files · 15548 linesPython 96 files · 15140 linesShell 14 files · 1222 lines
Files of concern · 6
skills/pattern-miner/package-lock.json JSON · 5812 lines
https://opencollective.com/eslint · https://opencollective.com/typescript-eslint · https://eslint.org/version-support
skills-archive/shopping-merchant-public-low-sensitivity-20260315-204610/package-lock.json JSON · 4782 lines
https://dotenvx.com · https://opencollective.com/express
agents/design/orchestrator/package-lock.json JSON · 4142 lines
https://opencollective.com/babel · https://opencollective.com/browserslist · https://tidelift.com/funding/github/npm/browserslist · https://tidelift.com/funding/github/npm/caniuse-lite · https://opencollective.com/fast-check · https://www.patreon.com/feross · https://feross.org/support · [email protected]
skills-archive/waimai-public-low-sensitivity-20260315-204610/scripts/waimai.js JavaScript · 2186 lines
https://www.ele.me · https://www.ele.me/search?keyword=$
skills/health-manager/package-lock.json JSON · 946 lines
https://opencollective.com/fastify
skills-archive/didi-public-low-sensitivity-20260315-204610/didi.py Python · 742 lines
120.0.0.0 · https://www.didiglobal.com · https://web.didiglobal.com · https://www.didiglobal.com/passport/login · https://web.didiglobal.com/trip/current · https://web.didiglobal.com/trip/history · https://web.didiglobal.com/coupon
Other files · waimai.js · package-lock.json · analyzer.ts · index.ts · TECHNICAL_SPEC.md · study-buddy.py

Security positives

安全模块(security.py)实现了 Fernet AES 对称加密存储,符合 Fernet 规范,AES-256-CBC + PBKDF2HMAC 用于密钥派生
SecureStorage 实现了安全文件删除(随机数据覆写后再删除),符合 NIST SP 800-88 标准
所有电商技能实现了用户 consent 机制,cookies 加密存储在 ~/.openclaw/data/
skill-assessment 实现了完整的安全扫描检测器(密钥检测、chmod 777、rm -rf、远程脚本执行)
加密服务使用 timingSafeEqual 防止时序攻击(encryption-service.ts verify/verifyPassword)
didi.py 和 shein-shopping.py 使用了 navigator.webdriver 反检测脚本,规避自动化识别
skills-archive 中的 skills 标注为 low-sensitivity 公开技能,聚焦于公开数据而非账户操作