Skill Trust Decision
perkoon-transfer
Browser Automation方法存在严重的远程代码执行(RCE)风险，通过curl动态下载并执行远程.mjs脚本，攻击者可随时修改服务器代码实施攻击。
Most direct threat evidence
Critical RCE
远程代码执行(RCE)风险 Browser Automation方法通过curl从perkoon.com下载.mjs脚本并用node执行。攻击者可入侵服务器修改脚本内容，在用户机器上执行任意代码。这是教科书式的供应链攻击路径。
SKILL.md:265 Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
12 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 2 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
用户安装perkoon-transfer skill伪装成合法文件传输工具
Entry · SKILL.md:1
02
使用Browser Automation方法的curl下载远程脚本
Escalation · SKILL.md:265
03
攻击者入侵perkoon.com服务器，修改.mjs脚本注入恶意代码
Escalation · perkoon.com
04
node执行恶意脚本，完成RCE、数据外泄或横向移动
Impact · SKILL.md:266
What drove the risk score up
远程脚本动态下载执行 +35
curl perkoon.com/perkoon_send.mjs && node执行，允许RCE
供应链风险 +20
动态从外部URL获取代码，无完整性校验
文档-行为差异 +10
Browser Automation方法未充分声明RCE风险
Most important evidence
Critical RCE
远程代码执行(RCE)风险
Browser Automation方法通过curl从perkoon.com下载.mjs脚本并用node执行。攻击者可入侵服务器修改脚本内容，在用户机器上执行任意代码。这是教科书式的供应链攻击路径。
SKILL.md:265 删除curl远程脚本模式，改用本地预装脚本或提供脚本哈希校验
High Supply Chain
无版本锁定的npm包依赖
虽然文档声称使用固定版本([email protected], @perkoon/[email protected])，但npx在网络不稳定或DNS被劫持时可能拉取错误版本。攻击者可注册同名包实施 typosquatting 攻击。
SKILL.md:37 使用npm ci或yarn配合lockfile，避免npx动态拉取
Medium Sensitive Access
访问敏感目录声明不完整
文档第10条规则提到'NEVER send files from sensitive directories (~/.ssh, ~/.gnupg, /etc)'，但未声明工具会主动检测或阻止此类访问。receive命令默认写入~/.openclaw/workspace/received/。
SKILL.md:219 增加对敏感目录的主动检测和用户确认机制
Low Obfuscation
第三方域名依赖
整个工具完全依赖perkoon.com域名，网络请求包括agent.json发现、API调用和脚本下载。若域名被劫持，所有功能面临风险。
SKILL.md:1 考虑支持自托管或提供域名可配置选项
Declared capability vs actual capability
Network Pass
Declared READ
→ Inferred WRITE
SKILL.md:265-266 curl下载远程脚本 Shell Block
Declared NONE
→ Inferred WRITE
SKILL.md:265 node执行.mjs脚本 Filesystem Block
Declared READ
→ Inferred WRITE
SKILL.md:267 保存脚本到本地文件 Suspicious artifacts and egress
Medium External URL
https://perkoon.com SKILL.md:10
Medium External URL
https://perkoon.com/K7MX4QPR9W2N SKILL.md:115
Medium External URL
https://perkoon.com/a2a SKILL.md:204
Medium External URL
https://perkoon.com/.well-known/agent.json SKILL.md:206
Medium External URL
https://perkoon.com/perkoon_send.mjs SKILL.md:315
Medium External URL
https://perkoon.com/perkoon_receive.mjs SKILL.md:316
Medium External URL
https://perkoon.com/create SKILL.md:321
Medium External URL
https://perkoon.com/ SKILL.md:332
Medium External URL
https://perkoon.com/llms.txt SKILL.md:428
Medium External URL
https://perkoon.com/automate SKILL.md:429
Medium External URL
https://www.npmjs.com/package/@perkoon/mcp SKILL.md:430
Medium External URL
https://www.npmjs.com/package/perkoon SKILL.md:431
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| perkoon | 0.4.6 | npm | No | CLI包，动态拉取 |
| @perkoon/mcp | 0.2.2 | npm | No | MCP服务器，动态拉取 |
| perkoon_send.mjs | N/A | curl remote | No | 远程脚本，无校验 |
File composition
1 files · 431 lines
Markdown 1 files · 431 lines
Files of concern · 1
SKILL.md 远程代码执行(RCE)风险 · 无版本锁定的npm包依赖 · 访问敏感目录声明不完整 · 第三方域名依赖 · https://perkoon.com · https://perkoon.com/K7MX4QPR9W2N · https://perkoon.com/a2a · https://perkoon.com/.well-known/agent.json · https://perkoon.com/perkoon_send.mjs · https://perkoon.com/perkoon_receive.mjs · https://perkoon.com/create · https://perkoon.com/ · https://perkoon.com/llms.txt · https://perkoon.com/automate · https://www.npmjs.com/package/@perkoon/mcp · https://www.npmjs.com/package/perkoon