Skill Trust Decision
peen
纯文档型skill，核心风险为文档中包含curl|bash远程脚本执行指令，虽符合声明的shell权限但仍是高危IOC
Most direct threat evidence
01
读取SKILL.md获取安装指令 Entry · SKILL.md
02
执行curl|bash安装远程脚本 Escalation · SKILL.md
03
install.sh在主机执行任意命令完成RCE Impact · references/setup.md
Why this conclusion was reached
2/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 3 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
读取SKILL.md获取安装指令
Entry · SKILL.md:1
02
执行curl|bash安装远程脚本
Escalation · SKILL.md:55
03
install.sh在主机执行任意命令完成RCE
Impact · references/setup.md:6
What drove the risk score up
curl|bash远程脚本执行 +25
SKILL.md:55 和 references/setup.md 包含 curl -fsSL <url> | bash 高危IOC
文档型skill无执行能力 +-10
纯Markdown文档，无脚本文件，能力边界清晰
远程URL无版本锁定 +10
install.sh 链接指向 main 分支，非固定版本tag
shell权限声明宽泛 +5
shell: curl * 允许任意URL下载
Most important evidence
High RCE
远程脚本管道执行
文档第55行和setup.md第6行包含 curl -fsSL https://raw.githubusercontent.com/psyb0t/peen/main/install.sh | bash，绕过安全最佳实践直接执行远程代码
SKILL.md:55 改用固定版本tag (如 v0.20.0) 并先验证hash后再执行
Medium Supply Chain
安装脚本无版本锁定
URL指向main分支而非固定release tag，远程可随时修改安装脚本内容
SKILL.md:55 使用 psyb0t/[email protected] 等固定版本
Low Priv Escalation
shell权限声明宽泛
声明 'curl *' 允许curl访问任意URL，存在潜在滥用空间
SKILL.md:20 限制为可信域名如 github.com
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:13-17 permissions.filesystem.write Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:18-20 permissions.shell contains 'curl *' Network Pass
Declared READ
→ Inferred READ
curl命令隐式网络访问，在声明范围内 Skill Invoke Pass
Declared NONE
→ Inferred NONE
无脚本文件 Suspicious artifacts and egress
Critical Dangerous Command
curl -fsSL https://raw.githubusercontent.com/psyb0t/peen/main/install.sh | bash SKILL.md:55
Medium External URL
https://aigate.example/v1 references/setup.md:19
Medium External URL
http://127.0.0.1:8080/api/v1/sessions/open references/setup.md:37
Medium External URL
http://127.0.0.1:8080/api/v1/messages?limit=50&order=asc references/setup.md:70
Medium External URL
http://127.0.0.1:8080/api/v1/session/cancel references/setup.md:73
Dependencies and supply chain
There are no structured dependency warnings.
File composition
2 files · 192 lines
Markdown 2 files · 192 lines
Files of concern · 2
SKILL.md 远程脚本管道执行 · 安装脚本无版本锁定 · shell权限声明宽泛 · curl -fsSL https://raw.githubusercontent.com/psyb0t/peen/main/install.sh | bash
references/setup.md https://aigate.example/v1 · http://127.0.0.1:8080/api/v1/sessions/open · http://127.0.0.1:8080/api/v1/messages?limit=50&order=asc · http://127.0.0.1:8080/api/v1/session/cancel
Security positives
纯文档型skill，无可执行代码，攻击面极小
声明与实际能力一致，无阴影功能
项目为真实开源项目（psyb0t/peen），有完整文档和社区
安全提示清晰：警告勿暴露SSH目录和凭证