安全决策报告
agent-guardian
A legitimate AI assistant monitoring skill with undeclared privileged operations and dependency installations, but no evidence of malicious behavior.
为什么得出这个结论
1/4 个维度触发 阻止
声明与实际能力
发现 2 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 2 个一般风险产物，需要结合上下文判断。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
发现 2 项需要关注的依赖或供应链线索。
风险分是怎么被拉高的
Undeclared privilege escalation +10
SKILL.md does not document that install.sh modifies system crontab, creates systemd services running as root, and installs packages via pip/apt
Unpinned package dependencies +5
pip3 install langdetect and apt-get install inotify-tools without version pinning could lead to unexpected behavior
Silent package installation +5
install.sh installs packages silently (2>/dev/null) without informing the user
apply-qqbot-patch.sh modifies bot source code +5
The patch script injects execSync calls and custom code blocks into gateway.ts/outbound.ts without prominent disclosure
最关键的证据
中危 权限提升
Undeclared root-level system modifications
install.sh creates a systemd service running as User=root, modifies system crontab, and installs system packages without declaring these capabilities in SKILL.md
scripts/install.sh:67 Document all system-level modifications (crontab, systemd, apt/pip installs) in SKILL.md. Consider running the daemon as a non-root user.
中危 文档欺骗
Plugin source code modification not documented in SKILL.md
apply-qqbot-patch.sh injects custom code blocks with execSync calls into the QQ bot's gateway.ts and outbound.ts. SKILL.md mentions 'apply channel patches' but doesn't detail the execSync implications.
scripts/apply-qqbot-patch.sh:20 Explicitly document in SKILL.md that the patch modifies plugin source files and embeds the skill path in execSync calls.
低危 供应链
Unpinned package dependencies
install.sh installs langdetect (pip) and inotify-tools (apt) without version pinning, risking unexpected behavior from breaking changes
scripts/install.sh:46 Pin versions: pip3 install langdetect==1.0.9 and apt-get install inotify-tools (or specify version)
低危 文档欺骗
Silent dependency installation
install.sh installs packages with 2>/dev/null redirection, suppressing output and potential error messages from the user
scripts/install.sh:47 Show installation progress to user, or at minimum log failures to a visible file
低危 敏感访问
Hardcoded root paths in scripts
smart-status-report.sh and status-query-daemon.sh hardcode /root paths and PATH variables containing root-specific binaries
scripts/smart-status-report.sh:6 Use dynamic paths based on actual user context, not hardcoded /root
声明能力 vs 实际能力
文件系统 通过
声明 WRITE
→ 推断 WRITE
SKILL.md declares script execution which writes to /tmp/ and patch files 命令执行 阻止
声明 NONE
→ 推断 WRITE
install.sh:46-54 apt-get install, install.sh:60 crontab modification, install.sh:67 systemctl with User=root, install.sh:42 pip3 install 网络访问 通过
声明 NONE
→ 推断 READ
smart-status-report.sh:58 openclaw message send, but this is the core messaging function documented in SKILL.md 环境变量 通过
声明 NONE
→ 推断 READ
supervisor.sh:77-82 reads memory/load via free/uptime; no credential harvesting observed 技能调用 阻止
声明 NONE
→ 推断 WRITE
apply-qqbot-patch.sh injects execSync calls into plugin source files 可疑产物与外联
中危 外部 URL
https://clawhub.ai/user/fanxinyun1991 skill-card.md:7
中危 外部 URL
https://clawhub.ai/fanxinyun1991/agent-guardian skill-card.md:31
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| langdetect | latest | pip | 否 | Version not pinned - breaking changes could affect functionality |
| inotify-tools | latest | apt | 否 | System package, version not pinned |
文件构成
15 个文件 · 1256 行
Shell 7 个文件 · 567 行Markdown 4 个文件 · 399 行Python 3 个文件 · 285 行JSON 1 个文件 · 5 行
需关注文件 · 4
scripts/install.sh Undeclared root-level system modifications · Unpinned package dependencies · Silent dependency installation
scripts/apply-qqbot-patch.sh Plugin source code modification not documented in SKILL.md
skill-card.md https://clawhub.ai/user/fanxinyun1991 · https://clawhub.ai/fanxinyun1991/agent-guardian
scripts/smart-status-report.sh Hardcoded root paths in scripts
其他文件 · msg-queue.py · SKILL.md · supervisor.sh · qqbot.md · lang-filter.py · generic.md +2
安全亮点
No base64 encoding, eval(), or obfuscation patterns detected
No credential harvesting from ~/.ssh, ~/.aws, .env, or similar sensitive paths
No reverse shell, C2 communication, or external IP connections
No data exfiltration to external servers (status messages go through configured openclaw channel only)
skill-card.md properly documents known risks including persistent host components and /tmp state files
apply-qqbot-patch.sh creates backups of original files before patching
Scripts use trap for proper cleanup (supervisor.sh:18)
Lock file mechanism prevents duplicate supervisor runs (supervisor.sh:15-22)
All /tmp/ files are ephemeral state files, not persistent credential stores