Skill Trust Decision
辛一金虹桥店7天排产预测
Skill sends three sensitive spreadsheets (sales history, SKU profit data, forecast templates) to an unidentified plain-HTTP IP with no operator identity, no HTTPS, and no declared data handling policy.
Most direct threat evidence
01
SKILL.md describes the skill as performing only local file existence checks, omitting any mention of external data upload Entry · SKILL.md
02
Skill collects full local paths to three sensitive spreadsheets from the user (sales history, SKU profit table, forecast template) Collection · SKILL.md
03
Assembles and executes a curl command that POSTs all three files to an unidentified plain-HTTP IP Exfiltration · SKILL.md
Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
SKILL.md describes the skill as performing only local file existence checks, omitting any mention of external data upload
Entry · SKILL.md:1
02
Skill collects full local paths to three sensitive spreadsheets from the user (sales history, SKU profit table, forecast template)
Collection · SKILL.md:14
03
Assembles and executes a curl command that POSTs all three files to an unidentified plain-HTTP IP
Exfiltration · SKILL.md:31
04
Business-sensitive data (sales history, profit margins) is transmitted over unencrypted HTTP to an unknown operator with no stated data handling policy
Impact · SKILL.md:31
What drove the risk score up
Sensitive data upload to unauthenticated plain-HTTP endpoint +25
SKILL.md assembles a curl command that POSTs sales history, SKU profit, and template spreadsheets to http://47.100.116.96:8000 — no TLS, no operator identity, no data handling disclosure
SKILL.md omits the upload behavior +15
SKILL.md describes only 'file existence checks' and 'assembling a command' but never mentions that three files are uploaded to an external server
Hardcoded plain-IP endpoint +10
47.100.116.96 is a bare IP address (not a domain), making operator attribution and accountability impossible
skill-card.md known-risks mitigation is incomplete +10
skill-card.md acknowledges 'unidentified plain-HTTP IP' risk but recommends only 'authorized data' without requiring HTTPS or identifying the operator
Most important evidence
High Data Exfil
Sensitive spreadsheets uploaded to unauthenticated plain-HTTP endpoint
SKILL.md instructs the agent to POST three local files (sales history, SKU profit table, forecast template) to http://47.100.116.96:8000/api/predict/fill-template over plain HTTP. The endpoint operator is unidentified, the connection is unencrypted, and no data retention, processing, or privacy policy exists.
SKILL.md:31 Migrate to an HTTPS endpoint with a verifiable domain, operator identity, and publicly documented data handling policy. Require user confirmation before transmitting any files.
Medium Doc Mismatch
SKILL.md omits the external file upload from its description
SKILL.md frames the skill as performing only local file existence checks and a 'command assembly.' It never mentions that user-provided spreadsheets are transmitted to an external server, leaving users unaware of the data leaving their environment.
SKILL.md:1 SKILL.md must explicitly declare: 'This skill uploads your provided spreadsheets to a remote forecasting service.'
Medium Supply Chain
Bare IP address used instead of a resolvable domain
The remote endpoint is a bare IP (47.100.116.96) rather than a DNS-resolvable domain. This prevents users from investigating the operator via WHOIS, SSL certificates, or reputation databases, and makes the service unaccountable.
SKILL.md:31 Use a domain name with a valid TLS certificate. Publish operator identity and contact information via the domain.
Low Priv Escalation
network:WRITE permission inferred but not declared
SKILL.md declares only filesystem:READ and shell:WRITE. The network:WRITE capability (uploading files to an external host) is not mentioned in the capability declaration.
SKILL.md:1 Update the declared capabilities to include network:WRITE if files are transmitted to external servers.
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred READ
SKILL.md: '快速验证：只检查文件是否存在 + 前1行列名检测' Network Block
Declared NONE
→ Inferred WRITE
SKILL.md:31 — curl POSTs three local files to external IP 47.100.116.96:8000; network:WRITE not declared Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:31 — assembles and executes a curl bash command Suspicious artifacts and egress
High IP Address
47.100.116.96 SKILL.md:31
Medium External URL
http://47.100.116.96:8000/api/predict/fill-template SKILL.md:31
Medium External URL
https://clawhub.ai/user/qq115566 skill-card.md:7
Medium External URL
https://clawhub.ai/qq115566/xinyi-ai skill-card.md:25
Dependencies and supply chain
There are no structured dependency warnings.
File composition
3 files · 88 lines
Markdown 2 files · 83 linesJSON 1 files · 5 lines
Files of concern · 2
SKILL.md Sensitive spreadsheets uploaded to unauthenticated plain-HTTP endpoint · SKILL.md omits the external file upload from its description · Bare IP address used instead of a resolvable domain · network:WRITE permission inferred but not declared · 47.100.116.96 · http://47.100.116.96:8000/api/predict/fill-template
skill-card.md https://clawhub.ai/user/qq115566 · https://clawhub.ai/qq115566/xinyi-ai
Other files · _meta.json
Security positives
No code execution or script files present — behavior is entirely declarative in SKILL.md
skill-card.md's Known Risks section does acknowledge the plaintext HTTP upload risk
File operations are scoped to existence checks with no bulk data reading
No credential harvesting, no environment variable iteration, no reverse shell code