安全决策报告
fin-advisor
A legitimate fund investment advisor skill with documented behavior, no malicious indicators, and only minor tool-permission gaps and undeclared external service calls.
为什么得出这个结论
1/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 2 个一般风险产物，需要结合上下文判断。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
发现 1 项需要关注的依赖或供应链线索。
风险分是怎么被拉高的
Tool mismatch — Edit used but not declared in allowed-tools +10
SKILL.md instructs the agent to use Edit to update USER.md, but allowed-tools only lists Read and Bash. This is a doc-to-code mismatch for a permission-related action.
Undeclared network egress via slot-filling service +5
scripts/slot-filling.sh makes HTTP POST requests to SLOT_SERVICE_URL (a user-provided external endpoint) with the query string. This is Bash/network behavior not declared in allowed-tools.
External URLs in skill-card.md +5
References to clawhub.ai external URLs — low-risk branding links, not indicators of malicious behavior.
最关键的证据
中危 文档欺骗
Edit tool used but not declared in allowed-tools
SKILL.md instructs the agent to use Edit to update USER.md's persona_preference field, but allowed-tools only declares Read(*.md) and Bash(mcporter:*). Edit (filesystem:WRITE) is a missing declaration.
SKILL.md:29 Add Edit to allowed-tools or restructure USER.md updates to use Bash/echo if Read-only is intentional.
低危 敏感访问
Undeclared external HTTP POST via slot-filling service
scripts/slot-filling.sh makes HTTP POST requests to a user-provided SLOT_SERVICE_URL with the query text and authorization header. This is indirect network egress via Bash/curl, not declared in allowed-tools.
scripts/slot-filling.sh:70 Document the slot-filling external service call in SKILL.md's allowed-tools section or add network:READ to the capability map. skill-card.md partially discloses this risk.
低危 权限提升
Workspace filesystem write scope not declared
SKILL.md references writing to 'workspace 目录下的 USER.md' and 'workspace目录', implying filesystem:WRITE access to the workspace, but allowed-tools only lists Read(*.md).
SKILL.md:17 Clarify workspace write scope in allowed-tools if direct file writes are expected beyond USER.md preferences.
声明能力 vs 实际能力
命令执行 通过
声明 WRITE
→ 推断 WRITE
allowed-tools: Bash(mcporter:*) — restricted to mcporter calls 文件系统 阻止
声明 READ
→ 推断 READ+WRITE
allowed-tools declares only Read(*.md), but SKILL.md instructs Edit to modify USER.md (filesystem:WRITE behavior) 网络访问 通过
声明 NONE
→ 推断 READ (indirect)
scripts/slot-filling.sh uses curl to POST to SLOT_SERVICE_URL, but this is not declared in allowed-tools or SKILL.md 环境变量 通过
声明 NONE
→ 推断 NONE
No direct os.environ iteration or sensitive env access observed 技能调用 通过
声明 NONE
→ 推断 NONE
No inter-skill invocation or MCP tool chaining beyond mcporter 剪贴板 通过
声明 NONE
→ 推断 NONE
No clipboard access detected 浏览器 通过
声明 NONE
→ 推断 NONE
No browser tool usage 数据库 通过
声明 NONE
→ 推断 NONE
No database access detected 可疑产物与外联
中危 外部 URL
https://clawhub.ai/user/Lovelcp skill-card.md:7
中危 外部 URL
https://clawhub.ai/Lovelcp/fin-advisor skill-card.md:29
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| jq | system | system CLI | 否 | Standard CLI tool, version not pinned |
| curl | system | system CLI | 否 | Standard CLI tool used only for local slot-filling service calls |
| mcporter | external | external MCP tool | 否 | External MCP tool broker — capabilities scoped to fund data API, not controlled by this skill |
文件构成
11 个文件 · 729 行
Markdown 9 个文件 · 598 行Shell 1 个文件 · 126 行JSON 1 个文件 · 5 行
需关注文件 · 3
SKILL.md Edit tool used but not declared in allowed-tools · Workspace filesystem write scope not declared
scripts/slot-filling.sh Undeclared external HTTP POST via slot-filling service
skill-card.md https://clawhub.ai/user/Lovelcp · https://clawhub.ai/Lovelcp/fin-advisor
其他文件 · tool-guide.md · domain-knowledge.md · output-guide.md · compliance.md · friendly.md · professional.md +2
安全亮点
No credential harvesting or sensitive path access (~/.ssh, ~/.aws, .env, etc.)
No base64-encoded execution, eval(), or obfuscation techniques detected
No reverse shell, C2, or data exfiltration to untrusted endpoints
No curl|bash or wget|sh remote script execution
Comprehensive compliance rules for investment advice with mandatory risk disclaimers
skill-card.md discloses known risks (USER.md storage, external slot-filling service, investment advice scope) proactively
slot-filling.sh has mock mode and graceful failure handling — no hard failure on service unavailability
Strong data integrity constraints: four-element compliance for financial data, zero-calc principle, MCP-tool-only data sourcing
Dependencies are standard CLI tools (jq, curl, bash) with no external pip/npm packages
Script is a simple bash wrapper with parameterized inputs, no dynamic code generation