安全决策报告
辛一金虹桥店7天排产预测
Skill sends three sensitive spreadsheets (sales history, SKU profit data, forecast templates) to an unidentified plain-HTTP IP with no operator identity, no HTTPS, and no declared data handling policy.
最直接的威胁证据
01
SKILL.md describes the skill as performing only local file existence checks, omitting any mention of external data upload 初始入口 · SKILL.md
02
Skill collects full local paths to three sensitive spreadsheets from the user (sales history, SKU profit table, forecast template) 数据收集 · SKILL.md
03
Assembles and executes a curl command that POSTs all three files to an unidentified plain-HTTP IP 数据外泄 · SKILL.md
为什么得出这个结论
3/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 4 步攻击链，另有 1 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
攻击链
01
SKILL.md describes the skill as performing only local file existence checks, omitting any mention of external data upload
初始入口 · SKILL.md:1
02
Skill collects full local paths to three sensitive spreadsheets from the user (sales history, SKU profit table, forecast template)
数据收集 · SKILL.md:14
03
Assembles and executes a curl command that POSTs all three files to an unidentified plain-HTTP IP
数据外泄 · SKILL.md:31
04
Business-sensitive data (sales history, profit margins) is transmitted over unencrypted HTTP to an unknown operator with no stated data handling policy
最终危害 · SKILL.md:31
风险分是怎么被拉高的
Sensitive data upload to unauthenticated plain-HTTP endpoint +25
SKILL.md assembles a curl command that POSTs sales history, SKU profit, and template spreadsheets to http://47.100.116.96:8000 — no TLS, no operator identity, no data handling disclosure
SKILL.md omits the upload behavior +15
SKILL.md describes only 'file existence checks' and 'assembling a command' but never mentions that three files are uploaded to an external server
Hardcoded plain-IP endpoint +10
47.100.116.96 is a bare IP address (not a domain), making operator attribution and accountability impossible
skill-card.md known-risks mitigation is incomplete +10
skill-card.md acknowledges 'unidentified plain-HTTP IP' risk but recommends only 'authorized data' without requiring HTTPS or identifying the operator
最关键的证据
高危 数据外泄
Sensitive spreadsheets uploaded to unauthenticated plain-HTTP endpoint
SKILL.md instructs the agent to POST three local files (sales history, SKU profit table, forecast template) to http://47.100.116.96:8000/api/predict/fill-template over plain HTTP. The endpoint operator is unidentified, the connection is unencrypted, and no data retention, processing, or privacy policy exists.
SKILL.md:31 Migrate to an HTTPS endpoint with a verifiable domain, operator identity, and publicly documented data handling policy. Require user confirmation before transmitting any files.
中危 文档欺骗
SKILL.md omits the external file upload from its description
SKILL.md frames the skill as performing only local file existence checks and a 'command assembly.' It never mentions that user-provided spreadsheets are transmitted to an external server, leaving users unaware of the data leaving their environment.
SKILL.md:1 SKILL.md must explicitly declare: 'This skill uploads your provided spreadsheets to a remote forecasting service.'
中危 供应链
Bare IP address used instead of a resolvable domain
The remote endpoint is a bare IP (47.100.116.96) rather than a DNS-resolvable domain. This prevents users from investigating the operator via WHOIS, SSL certificates, or reputation databases, and makes the service unaccountable.
SKILL.md:31 Use a domain name with a valid TLS certificate. Publish operator identity and contact information via the domain.
低危 权限提升
network:WRITE permission inferred but not declared
SKILL.md declares only filesystem:READ and shell:WRITE. The network:WRITE capability (uploading files to an external host) is not mentioned in the capability declaration.
SKILL.md:1 Update the declared capabilities to include network:WRITE if files are transmitted to external servers.
声明能力 vs 实际能力
文件系统 通过
声明 READ
→ 推断 READ
SKILL.md: '快速验证：只检查文件是否存在 + 前1行列名检测' 网络访问 阻止
声明 NONE
→ 推断 WRITE
SKILL.md:31 — curl POSTs three local files to external IP 47.100.116.96:8000; network:WRITE not declared 命令执行 通过
声明 WRITE
→ 推断 WRITE
SKILL.md:31 — assembles and executes a curl bash command 可疑产物与外联
高危 IP 地址
47.100.116.96 SKILL.md:31
中危 外部 URL
http://47.100.116.96:8000/api/predict/fill-template SKILL.md:31
中危 外部 URL
https://clawhub.ai/user/qq115566 skill-card.md:7
中危 外部 URL
https://clawhub.ai/qq115566/xinyi-ai skill-card.md:25
依赖与供应链
没有结构化依赖告警。
文件构成
3 个文件 · 88 行
Markdown 2 个文件 · 83 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Sensitive spreadsheets uploaded to unauthenticated plain-HTTP endpoint · SKILL.md omits the external file upload from its description · Bare IP address used instead of a resolvable domain · network:WRITE permission inferred but not declared · 47.100.116.96 · http://47.100.116.96:8000/api/predict/fill-template
skill-card.md https://clawhub.ai/user/qq115566 · https://clawhub.ai/qq115566/xinyi-ai
其他文件 · _meta.json
安全亮点
No code execution or script files present — behavior is entirely declarative in SKILL.md
skill-card.md's Known Risks section does acknowledge the plaintext HTTP upload risk
File operations are scoped to existence checks with no bulk data reading
No credential harvesting, no environment variable iteration, no reverse shell code