Skill Trust Decision
ludwitt-university
Ludwitt University 是一个声称合法的 AI 教育平台技能，但存在机器指纹收集并外传、文档中引导执行远程脚本、后台持久化服务等可疑行为，虽非典型恶意软件但存在多项安全风险。
Most direct threat evidence
High Doc Mismatch
文档引导执行远程脚本 SKILL.md 和 install.sh 注释中展示 curl -sSL https://opensource.ludwitt.com/install | sh 危险模式，用户可能被诱导直接执行未验证的远程代码
SKILL.md:63 Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 3 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
文档引导危险操作 +15
SKILL.md 和 install.sh 注释中多处展示 curl|sh 远程执行命令
机器指纹收集外传 +12
install.sh:61-67 收集 hostname/platform/arch/cpu 生成 SHA256 指纹并发送至外部 API
后台持久化服务 +8
install.sh 注册 launchd/systemd 守护进程，开机自启，每10分钟轮询外部 API
AI 框架追踪 +5
install.sh:71-82 检测 OPENCLAW/CURSOR/CLAUDE_CODE 等环境变量并上报
本地文件外传 +5
daemon.js:360-381 读取本地反射论文并上传至远程服务器
Most important evidence
High Doc Mismatch
文档引导执行远程脚本
SKILL.md 和 install.sh 注释中展示 curl -sSL https://opensource.ludwitt.com/install | sh 危险模式，用户可能被诱导直接执行未验证的远程代码
SKILL.md:63 使用安全安装模式：先下载脚本到本地、验证校验和、审查后再执行
High Sensitive Access
机器指纹收集并外传
install.sh 收集 hostname/platform/arch/cpu model，生成 SHA256 指纹，发送至 opensource.ludwitt.com 用于识别和追踪设备
install.sh:61 避免收集可识别设备的指纹信息，或仅在本地使用而不外传
High Persistence
后台守护进程持久化
install.sh 注册 launchd (macOS) 或 systemd (Linux) 守护进程，实现开机自启和持续后台运行，每10分钟轮询外部 API
install.sh:171 明确告知用户持久化风险，提供卸载说明，使用户能够完全移除服务
Medium Supply Chain
远程脚本执行依赖
技能依赖于外部服务器 opensource.ludwitt.com 的可访问性，服务器端代码不可审计，存在供应链风险
SKILL.md:44 评估外部服务依赖风险，考虑自托管或离线使用场景
Medium Data Exfil
本地文件内容上传
daemon.js 读取用户编写的反射论文 (~/.ludwitt/reflection-*.md) 并作为 submission payload 上传至远程服务器
daemon.js:376 明确告知用户哪些本地文件内容会被上传，避免在反射论文中包含敏感信息
Medium Sensitive Access
AI 框架环境变量检测上报
install.sh 检测 OPENCLAW_STATE_DIR/CURSOR_SESSION_ID/CLAUDE_CODE_SESSION 等环境变量，判断运行框架并上报至服务器
install.sh:71 明确说明收集的框架信息及其用途，提供退出选项
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:23-24 声明需要文件读写权限 Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:23 声明需要代码执行能力 Network Pass
Declared READ,WRITE
→ Inferred READ,WRITE
SKILL.md 声明调用 Ludwitt API Environment Block
Declared NONE
→ Inferred READ
install.sh:71-82 读取 OPENCLAW_STATE_DIR/CURSOR_SESSION_ID/CLAUDE_CODE_SESSION 等环境变量 Suspicious artifacts and egress
Critical Dangerous Command
curl -sSL https://opensource.ludwitt.com/install | sh daemon.js:42
Medium External URL
https://opensource.ludwitt.com README.md:34
Medium External URL
https://your-deployed-app.vercel.app SKILL.md:181
Medium External URL
https://www.youtube.com/watch?v=... SKILL.md:183
Medium External URL
https://opensource.ludwitt.com/install daemon.js:42
Medium External URL
http://www.apple.com/DTDs/PropertyList-1.0.dtd install.sh:216
Medium External URL
https://clawhub.ai/user/rogerSuperBuilderAlpha skill-card.md:7
Medium External URL
https://clawhub.ai/rogerSuperBuilderAlpha/ludwitt-university skill-card.md:29
Dependencies and supply chain
There are no structured dependency warnings.
File composition
6 files · 1469 lines
JavaScript 1 files · 728 linesMarkdown 3 files · 413 linesShell 1 files · 323 linesJSON 1 files · 5 lines
Files of concern · 5
daemon.js 本地文件内容上传 · curl -sSL https://opensource.ludwitt.com/install | sh · https://opensource.ludwitt.com/install
install.sh 机器指纹收集并外传 · 后台守护进程持久化 · AI 框架环境变量检测上报 · http://www.apple.com/DTDs/PropertyList-1.0.dtd
SKILL.md 文档引导执行远程脚本 · 远程脚本执行依赖 · https://your-deployed-app.vercel.app · https://www.youtube.com/watch?v=...
README.md https://opensource.ludwitt.com
skill-card.md https://clawhub.ai/user/rogerSuperBuilderAlpha · https://clawhub.ai/rogerSuperBuilderAlpha/ludwitt-university
Other files · _meta.json
Security positives
代码结构清晰，无明显混淆或恶意混淆技术
所有主要功能在 SKILL.md 文档中有记录
未发现凭证收割、键盘记录或反向 shell 等典型恶意行为
API 请求使用 HTTPS 加密传输
本地凭证文件 auth.json 设置 600 权限保护