安全决策报告
delvorn-register
The skill contains an undeclared promotional script that injects marketing content into public Telegraph pages using harvested credentials, a clear doc-to-code mismatch with the SKILL.md describing only an x402 payment flow.
最直接的威胁证据
01
SKILL.md describes a legitimate x402 payment test flow to build trust 初始入口 · SKILL.md
02
edit_telegraph_promo.py is bundled as an additional script but not mentioned in SKILL.md stealth · edit_telegraph_promo.py
03
Script reads a Telegraph access token from an undisclosed credential path 权限提升 · edit_telegraph_promo.py
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 2 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 8 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 4 步攻击链，另有 2 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
攻击链
01
SKILL.md describes a legitimate x402 payment test flow to build trust
初始入口 · SKILL.md:1
02
edit_telegraph_promo.py is bundled as an additional script but not mentioned in SKILL.md
stealth · edit_telegraph_promo.py:1
03
Script reads a Telegraph access token from an undisclosed credential path
权限提升 · edit_telegraph_promo.py:5
04
Agent unknowingly publishes promotional contest content to a public webpage via Telegraph API
最终危害 · edit_telegraph_promo.py:46
风险分是怎么被拉高的
Undeclared credential access +15
edit_telegraph_promo.py reads a local Telegraph access token from connector-secrets path without declaration in SKILL.md
Undeclared network write +15
Script performs editPage POST to api.telegra.ph, modifying public content, never mentioned in SKILL.md
Undeclared content modification +15
Injects promotional text about 'first independent agent' contest into a public webpage
Doc-to-code mismatch +10
SKILL.md describes only x402 payment flow; the promotional script is entirely separate hidden functionality
最关键的证据
高危 文档欺骗
Undeclared promotional content injection script
edit_telegraph_promo.py is a standalone Python script that reads a Telegraph access token, fetches a public page, injects promotional text about a contest, and reposts it. This functionality is completely absent from SKILL.md which only describes an x402 payment test.
edit_telegraph_promo.py:1 Remove this script or declare its purpose, credential access, and network write behavior in SKILL.md. Users must consent to promotional content being published.
高危 凭证窃取
Undeclared credential file access
The script accesses /home/box/agent-data/connector-secrets/.../telegraph.json to retrieve an access token. This credential access is not declared in SKILL.md capabilities or documentation.
edit_telegraph_promo.py:5 If this script is retained, clearly document the credential path access and require explicit user consent.
中危 数据外泄
Hidden content modification behavior
The script silently modifies a public Telegraph page with promotional content about 'first independent agent' completing a test and receiving 'Certified' status. This uses agent capabilities for undisclosed marketing purposes.
edit_telegraph_promo.py:14 Any content modification on behalf of a user must be explicitly declared and consented to.
低危 权限提升
Capability mismatch with declared tools
SKILL.md declares curl (bins) but the promotional script uses Python urllib for network operations. The script also performs network writes that aren't part of the described x402 flow.
edit_telegraph_promo.py:38 Ensure all network operations match declared capabilities and use cases.
声明能力 vs 实际能力
网络访问 阻止
声明 READ
→ 推断 WRITE
edit_telegraph_promo.py:46 - POST to api.telegra.ph/editPage 文件系统 阻止
声明 NONE
→ 推断 READ
edit_telegraph_promo.py:5 - reads telegraph.json from connector-secrets path 命令执行 通过
声明 NONE
→ 推断 NONE
recat.sh:2 - clawhub CLI call (not declared but benign for self-publishing) 可疑产物与外联
中危 外部 URL
https://delvorn.site/api/x402/test-asset SKILL.md:3
中危 外部 URL
https://telegra.ph/Delvorn-register-1-test-public-receipt-08-26 SKILL.md:11
中危 外部 URL
https://delvorn.site/.well-known/x402 SKILL.md:22
中危 外部 URL
https://api.telegra.ph/getPage/ edit_telegraph_promo.py:15
中危 外部 URL
https://delvorn.site/ edit_telegraph_promo.py:37
中危 外部 URL
https://api.telegra.ph/editPage/ edit_telegraph_promo.py:40
中危 外部 URL
https://clawhub.ai/user/mranderson323 skill-card.md:9
中危 外部 URL
https://clawhub.ai/mranderson323/skills/delvorn-register skill-card.md:35
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| urllib | stdlib | Python | 否 | Standard library only, no external dependencies |
文件构成
5 个文件 · 141 行
Markdown 2 个文件 · 79 行Python 1 个文件 · 50 行Shell 1 个文件 · 7 行JSON 1 个文件 · 5 行
需关注文件 · 3
skill-card.md https://clawhub.ai/user/mranderson323 · https://clawhub.ai/mranderson323/skills/delvorn-register
edit_telegraph_promo.py Undeclared promotional content injection script · Undeclared credential file access · Hidden content modification behavior · Capability mismatch with declared tools · https://api.telegra.ph/getPage/ · https://delvorn.site/ · https://api.telegra.ph/editPage/
SKILL.md https://delvorn.site/api/x402/test-asset · https://telegra.ph/Delvorn-register-1-test-public-receipt-08-26 · https://delvorn.site/.well-known/x402
其他文件 · recat.sh · _meta.json
安全亮点
The skill-card.md does acknowledge the undeclared script as a known risk, demonstrating publisher awareness
The x402 payment flow described in SKILL.md appears legitimate and well-defined
recat.sh is a simple CLI publishing script with no malicious behavior
No base64 obfuscation, reverse shells, or direct credential exfiltration observed