中文 EN
Start Review
Skill Trust Decision

aigate

纯文档型部署技能，声称功能与实际代码（外部GitHub项目）一致，无恶意行为，文档详尽描述了高能力带来的风险和缓解措施。

Install decision first Source: ClawHub Scanned: 12 days ago
Files 3
Artifacts 2
Violations 0
Findings 3

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review
Hidden execution and egress

2 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass
Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

纯文档技能 +-10

无实际可执行脚本，仅为部署指南

高能力栈声明 +15

文档明确描述了代码执行、浏览器自动化、凭证聚合等高风险能力，但提供了充分的缓解措施

文档完整透明 +-15

Security & safety章节详尽，覆盖所有主要风险点

Most important evidence

Medium Priv Escalation

高能力聚合导致权限边界模糊

单一AIGATE_TOKEN同时承载API密钥持有、代码执行(claudebox/pibox-zai/pibox)、浏览器自动化、邮件/ Telegram消息发送等能力，形成极大攻击面。文档虽明确警告但未提供开箱即用的细粒度权限隔离。

SKILL.md:1
操作员需理解这是架构设计限制而非漏洞：需要手动为每个服务单独设置AUTH_TOKEN以实现权限隔离；仅向完全可信的Agent授予master token。
Low Supply Chain

依赖外部GitHub仓库

该技能仅提供部署指南，实际代码来自 https://github.com/psyb0t/aigate。技能本身不携带恶意代码，但上游仓库的完整性不在本技能范围内。

SKILL.md:6
建议操作员在部署前审查上游仓库的最新提交和issues。
Info Doc Mismatch

文档透明度评分

文档-行为一致性检查：无阴影功能发现。所有声明的能力均有合理用途（自托管AI网关），文档详尽描述了风险和缓解措施，未发现文档欺骗。

SKILL.md:1
无需行动。这是正面信号。

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred NONE
SKILL.md 无文件系统写入声明，本身为纯文档技能
Network Pass
Declared READ
→
Inferred READ
permissions.network: outbound HTTP to localhost:4000, model providers, MCP backends
Shell Pass
Declared WRITE
→
Inferred WRITE
permissions.shell: docker/docker compose, curl
Environment Pass
Declared NONE
→
Inferred NONE
无环境变量遍历或凭证收割行为
Skill Invoke Pass
Declared NONE
→
Inferred NONE
无子技能调用
Clipboard Pass
Declared NONE
→
Inferred NONE
无剪贴板操作
Browser Pass
Declared WRITE
→
Inferred WRITE
stealth Camoufox cluster，文档明确声明
Database Pass
Declared NONE
→
Inferred NONE
仅通过Docker Compose部署PostgreSQL/Redis，无直接访问

Suspicious artifacts and egress

Medium External URL
https://clawhub.ai/user/psyb0t

skill-card.md:9

Medium External URL
https://clawhub.ai/psyb0t/skills/aigate

skill-card.md:39

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
aigate 6.2.0 external GitHub (psyb0t/aigate) No 外部依赖，本技能仅提供部署文档，实际代码不在本技能包内

File composition

3 files · 252 lines
Markdown 3 files · 252 lines
Files of concern · 2
SKILL.md Markdown · 109 lines
高能力聚合导致权限边界模糊 · 依赖外部GitHub仓库 · 文档透明度评分
skill-card.md Markdown · 59 lines
https://clawhub.ai/user/psyb0t · https://clawhub.ai/psyb0t/skills/aigate
Other files · setup.md

Security positives

纯文档技能，无可执行代码，排除代码层面恶意行为可能
文档透明详尽，包含完整Security & safety章节（19行）
明确声明了所有高风险能力（代码执行、浏览器自动化、凭证聚合）
提供了具体可操作的安全建议（Cloudflare Tunnel/Tailscale、端口不暴露、token隔离）
skill-card.md 包含 Known Risks and Mitigations 章节，与 SKILL.md 保持一致
MIT-0 许可证，商业使用友好
外部链接指向已知的公开GitHub项目，非未知仓库