Skill Trust Decision
xerg
纯文档型技能，通过npx执行外部npm包实现功能。权限声明与文档行为存在偏差（skill_invoke:ADMIN未使用、database:WRITE缺失），存在供应链风险和未声明的网络写权限。
Most direct threat evidence
Why this conclusion was reached
1/4 dimensions flagged Block
Declared vs actual capability
4 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
10 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
What drove the risk score up
供应链依赖风险 +10
通过npx执行外部npm包@xerg/cli，无法审查实际代码行为
权限声明-行为偏差 +10
声明skill_invoke:ADMIN但文档未使用；未声明database:WRITE但读取Hermes state.db
未声明的network:WRITE +8
activate --push-latest会POST审计结果到api.xerg.ai，但只声明network:READ
外部依赖声明宽泛 +5
SSH/rsync/railway/fly列为依赖但未明确是否实际调用
文档透明度高 +-5
文档详细说明权限请求、用户确认机制和边界限制
Most important evidence
Medium Supply Chain
外部npm包供应链依赖
技能通过npx执行外部包@xerg/cli，无法审查实际代码。所有功能实现依赖于第三方npm包。
SKILL.md:62 考虑fork npm包或使用预安装模式，确保可审查代码版本
Medium Priv Escalation
权限声明超出实际需要
声明skill_invoke:ADMIN但文档中未使用此权限。技能仅调用npx命令，不涉及技能间调用。
_meta.json:4 将skill_invoke降级为NONE，与实际使用一致
Medium Priv Escalation
缺少database权限声明
文档明确说明读取Hermes state.db（SQLite数据库），但未声明database:READ权限。
SKILL.md:128 在_meta.json中添加database:READ权限声明
Low Priv Escalation
缺少filesystem权限声明
技能读取日志文件、转录文件等本地数据，但未声明filesystem:READ。
SKILL.md:109 添加filesystem:READ或明确列出需要访问的路径
Low Priv Escalation
未声明的network:WRITE
activate --push-latest命令将审计结果POST到api.xerg.ai，但权限声明只有network:READ。
SKILL.md:77 将network:READ更新为network:WRITE或network:READ+network:WRITE
Low Doc Mismatch
外部工具依赖声明不明确
dependencies列表包含ssh/rsync/railway/fly，但文档未明确这些是否实际被调用。SSH/rsync可能用于远程审计功能。
_meta.json:18 明确标注这些依赖的可选性质或实际使用场景
Declared capability vs actual capability
Environment Pass
Declared READ
→ Inferred READ
SKILL.md:30-40 声明读取XERG_API_KEY等变量 Network Block
Declared READ
→ Inferred WRITE
SKILL.md:77 activate --push-latest POST数据到api.xerg.ai Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:62-67 所有npx命令执行 Skill Invoke Block
Declared ADMIN
→ Inferred NONE
_meta.json:4 声明但SKILL.md未使用 Database Block
Declared NONE
→ Inferred READ
SKILL.md:125-128 读取Hermes state.db Filesystem Block
Declared NONE
→ Inferred READ
SKILL.md:109-115 读取日志、转录文件、CSV Suspicious artifacts and egress
Medium External URL
https://xerg.ai/skill.md README.md:9
Medium External URL
https://xerg.ai/docs README.md:10
Medium External URL
https://status.xerg.ai README.md:11
Medium External URL
https://api.xerg.ai. README.md:32
Medium External URL
https://www.npmjs.com/package/@xerg/cli README.md:39
Medium External URL
https://www.openssh.com/ README.md:42
Medium External URL
https://rsync.samba.org/ README.md:45
Medium External URL
https://fly.io/docs/flyctl/ README.md:51
Medium External URL
https://xerg.ai/agents README.md:66
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| @xerg/cli | latest | npm | No | 外部npm包，实际代码不可审查 |
| ssh | N/A | system | No | 外部二进制，用于远程审计功能 |
| rsync | N/A | system | No | 外部二进制，用于远程审计功能 |
| railway | N/A | npm | No | Railway CLI依赖 |
| fly | N/A | system | No | Fly.io CLI依赖 |
File composition
2 files · 442 lines
Markdown 2 files · 442 lines
Files of concern · 2
README.md https://xerg.ai/skill.md · https://xerg.ai/docs · https://status.xerg.ai · https://api.xerg.ai. · https://www.npmjs.com/package/@xerg/cli · https://www.openssh.com/ · https://rsync.samba.org/ · https://fly.io/docs/flyctl/ · https://xerg.ai/agents · [email protected]
SKILL.md 外部npm包供应链依赖 · 缺少database权限声明 · 缺少filesystem权限声明 · 未声明的network:WRITE
Security positives
文档透明度高，详细说明权限请求和用户确认机制
明确禁止自动推送数据，强调本地优先
明确禁止粘贴API密钥到终端
QM场景有专门的私有作用域程序
不处理provider bills，边界清晰
明确说明credential处理的限制