中文 EN
Start Review
Skill Trust Decision

astraflow-remote-lab

技能功能正常但存在多处声明-行为差异：未声明沙箱内进程管理、软件安装、Chrome自动启动等行为；base64管道执行虽为安全目的但符合代码混淆特征。

Install decision first Source: ClawHub Scanned: 25 days ago
Files 6
Artifacts 3
Violations 1
Findings 5
Most direct threat evidence

Why this conclusion was reached

2/4 dimensions flagged
Block
Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

What drove the risk score up

未声明的沙箱内进程管理 +15

SKILL.md未声明启动Xvfb/xfce4/x11vnc/websockify等进程

未声明的软件安装行为 +10

沙箱内通过sudo apt-get安装freerdp2-x11/novnc/websockify等

base64管道执行脚本 +12

bridge_windows_uhost.py:65 和 manage_sandbox.py:112 使用base64管道执行远程脚本

Chrome自动启动并访问google.com +5

manage_sandbox.py:87 启动Chrome访问google.com，未在文档声明

Most important evidence

Medium Doc Mismatch

沙箱内进程管理未声明

SKILL.md未提及沙箱内会启动和管理Xvfb、xfce4-session、xfwm4、xfdesktop、x11vnc、websockify等桌面环境进程

scripts/manage_sandbox.py:34
在SKILL.md中补充说明沙箱内桌面环境管理行为
Medium Doc Mismatch

软件包安装行为未声明

沙箱内通过sudo apt-get安装freerdp2-x11、novnc、websockify等软件包，但SKILL.md未声明

scripts/bridge_windows_uhost.py:46
在SKILL.md中声明所需系统依赖
Medium Obfuscation

base64管道执行远程脚本

使用base64编码传输并执行脚本，虽为安全目的(避免密码在命令行可见)但符合代码混淆特征

scripts/bridge_windows_uhost.py:65
考虑使用更透明的方式传输脚本内容，或在文档中明确说明使用base64的安全原因
Low Doc Mismatch

Chrome自动启动未声明

沙箱创建后会自动启动Chrome浏览器并访问google.com，此行为未在SKILL.md中声明

scripts/manage_sandbox.py:87
在SKILL.md中说明沙箱创建后会启动Chrome进行验证
Low Persistence

创建autostart配置实现持久化

REPAIR脚本在沙箱内创建autostart desktop文件实现进程守护，虽为防休眠的合理设计但未声明

scripts/manage_sandbox.py:47
在SKILL.md中说明防休眠守护机制

Declared capability vs actual capability

Filesystem Pass
Declared READ
→
Inferred WRITE
scripts/manage_sandbox.py:115 - 在沙箱内写入脚本和配置
Shell Block
Declared NONE
→
Inferred WRITE
scripts/bridge_windows_uhost.py:65 - base64管道执行远程脚本
Environment Pass
Declared READ
→
Inferred READ
scripts/manage_sandbox.py:163 - 读取UCLOUD_SANDBOX_API_KEY
Network Pass
Declared READ
→
Inferred READ
使用官方SDK连接云服务

Suspicious artifacts and egress

Critical Encoded Execution
base64 -d

scripts/bridge_windows_uhost.py:65

Medium External URL
https://www.ucloud.cn/site/active/astraflow-credit?ytag=geo_waituo_SKillhub

SKILL.md:10

Medium External URL
https://www.google.com

scripts/manage_sandbox.py:118

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
ucloud-sandbox * pip No 官方SDK，无版本锁定

File composition

6 files · 670 lines
Python 2 files · 364 linesMarkdown 4 files · 306 lines
Files of concern · 3
scripts/manage_sandbox.py Python · 268 lines
沙箱内进程管理未声明 · Chrome自动启动未声明 · 创建autostart配置实现持久化 · https://www.google.com
SKILL.md Markdown · 151 lines
https://www.ucloud.cn/site/active/astraflow-credit?ytag=geo_waituo_SKillhub
scripts/bridge_windows_uhost.py Python · 96 lines
软件包安装行为未声明 · base64管道执行远程脚本 · base64 -d
Other files · architecture_and_pitfalls.md · api_reference.md · README.md

Security positives

敏感数据(密码、代理)通过base64编码后写入临时文件再用shred销毁，有安全意识
kill命令包含确认提示，防止误操作
凭证通过环境变量注入，不在命令行明文传递
使用官方ucloud-sandbox SDK而非直接调用API
时区自动同步等用户体验优化