Skill Trust Decision
solo-mission
技能核心功能正常但存在供应链风险：wallet-setup.md 引用的远程脚本安装命令未在 SKILL.md 声明权限中明确说明，且与私钥处理的安全谨慎态度不一致。
Most direct threat evidence
High Supply Chain
未声明的远程脚本执行（Foundry 安装） wallet-setup.md:29 包含 `curl -L https://foundry.paradigm.xyz | bash`，通过 bash 管道执行远程脚本安装 Foundry。SKILL.md 的 compatibility 字段声明了依赖但未说明安装方式，skill-card.md 的 declaredPermissions 中无对应记录。这是典型的远程代码执行风险，且与 skill 对私钥处理的极度谨慎态度不一致（'NEVER ask for PRIVATE_KEY'）。
references/wallet-setup.md:29 Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
未声明的远程脚本执行 +20
wallet-setup.md:29 包含 `curl -L https://foundry.paradigm.xyz | bash`，用于安装 Foundry，但 SKILL.md 的 compatibility 字段仅声明 '需要 Foundry cast'，未说明安装方式，也未在 skill-card.md 声明。
凭证持久化行为 +10
Agent Registration 流程将 SOLO_AGENT_KEY 写入 .claude/settings.local.json，该行为在 skill-card.md 'Known Risks' 中已披露但未在 declaredPermissions 明确声明 filesystem:WRITE 权限范围。
安全设计合理（正向） +-10
私钥处理有完善的生命周期管理（加密存储→运行时解密→立即 unset），API 凭证仅用于平台通信，不访问系统凭证，shell 执行均为必需的链上操作。
脚本执行有条件限制 +-5
wallet-setup.md 开头明确标注 'Skip this if you already have a funding tool'，且包含人工操作警告，降低了自动执行风险。
Most important evidence
High Supply Chain
未声明的远程脚本执行（Foundry 安装）
wallet-setup.md:29 包含 `curl -L https://foundry.paradigm.xyz | bash`，通过 bash 管道执行远程脚本安装 Foundry。SKILL.md 的 compatibility 字段声明了依赖但未说明安装方式，skill-card.md 的 declaredPermissions 中无对应记录。这是典型的远程代码执行风险，且与 skill 对私钥处理的极度谨慎态度不一致（'NEVER ask for PRIVATE_KEY'）。
references/wallet-setup.md:29 移除远程脚本执行命令，改为：1) 使用主流包管理器（brew install foundry, apt install foundryup）；2) 或明确标注为人工操作步骤，Agent 仅在检测到缺失时提示用户手动安装。
Medium Priv Escalation
凭证持久化行为权限未声明
Agent Registration 流程将 SOLO_AGENT_KEY 持久化写入 .claude/settings.local.json，属于 filesystem:WRITE 操作。skill-card.md 'Known Risks' 中有文字描述但未在 declaredPermissions 中明确声明 filesystem 权限，且写入路径 (.claude/settings.local.json) 未限制。
SKILL.md:56 在 skill-card.md 的 declaredPermissions 中添加 filesystem:WRITE，并明确写入路径限制（如仅限 .claude/ 目录）。
Low Doc Mismatch
依赖声明粒度不足
SKILL.md 声明 'Requires curl and jq. On-chain missions additionally require Foundry cast and openssl'，但未区分工具依赖 vs 安装方式。wallet-setup.md 中的远程脚本执行是对该声明的具体化，但未形成明确的引用关系。
SKILL.md:7 将 compatibility 字段改为明确说明安装方式，或在 references/ 引用关系中建立显式关联。
Declared capability vs actual capability
Network Pass
Declared READ
→ Inferred READ
SKILL.md:13 X-Agent-Key 调用 API Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:26-28 session start scan, cast send calls Filesystem Block
Declared NONE
→ Inferred WRITE
SKILL.md:56 mkdir + jq 写入 .claude/settings.local.json; skill-card.md 未声明 Environment Pass
Declared READ
→ Inferred READ
SKILL.md:8 primaryEnv: SOLO_AGENT_KEY Skill Invoke Pass
Declared NONE
→ Inferred NONE
N/A Suspicious artifacts and egress
Critical Dangerous Command
curl -L https://foundry.paradigm.xyz | bash references/wallet-setup.md:29
Medium External URL
https://api.mission.projectsolo.xyz SKILL.md:47
Medium External URL
https://api.mission.projectsolo.xyz/agent/missions?limit=100&page=$PAGE SKILL.md:83
Medium External URL
https://api.mission.projectsolo.xyz/agent/register SKILL.md:109
Medium External URL
https://sepolia.base.org SKILL.md:232
Medium External URL
https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/confirm-funding SKILL.md:258
Medium External URL
https://mission.projectsolo.xyz/missions/ SKILL.md:274
Medium External URL
https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/cancel-params SKILL.md:391
Medium External URL
https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/confirm-cancel SKILL.md:400
Medium External URL
https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/emergency-refund-params SKILL.md:408
Medium External URL
https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/confirm-emergency-refund SKILL.md:417
Medium External URL
https://api.mission.projectsolo.xyz/agent/missions SKILL.md:476
Dependencies and supply chain
There are no structured dependency warnings.
File composition
7 files · 1754 lines
Markdown 6 files · 1749 linesJSON 1 files · 5 lines
Files of concern · 5
SKILL.md 凭证持久化行为权限未声明 · 依赖声明粒度不足 · https://api.mission.projectsolo.xyz · https://api.mission.projectsolo.xyz/agent/missions?limit=100&page=$PAGE · https://api.mission.projectsolo.xyz/agent/register · https://sepolia.base.org · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/confirm-funding · https://mission.projectsolo.xyz/missions/ · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/cancel-params · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/confirm-cancel · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/emergency-refund-params · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/confirm-emergency-refund · https://api.mission.projectsolo.xyz/agent/missions · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/tracks/upload-url · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/tracks/$TRACK_ID/confirm · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/tracks · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/finalize-qualification · https://api.mission.projectsolo.xyz/agent/missions/$MISSION_ID/settle
references/rest-api.md https://mission.projectsolo.xyz/missions/$MISSION_ID\
references/onchain.md 0x6537Dcb39517A30e13C246560E7F58Bb7C2Fc2b2 · 0x036CbD53842c5426634e7929541eC2318f3dCF7e
references/wallet-setup.md 未声明的远程脚本执行（Foundry 安装） · curl -L https://foundry.paradigm.xyz | bash · https://foundry.paradigm.xyz · https://docs.base.org/docs/tools/network-faucets · https://faucet.circle.com
skill-card.md https://clawhub.ai/user/wj-solo · https://clawhub.ai/wj-solo/solo-mission
Other files · stuck-recovery.md · _meta.json
Security positives
私钥生命周期管理设计完善：加密存储→运行时解密→立即 unset，不在日志/对话中暴露
API 凭证（SOLO_AGENT_KEY）仅用于平台通信，不访问系统凭证（~/.ssh、~/.aws 等）
wallet-setup.md 包含详细的安全警告（'NEVER paste private key into AI chat'），且标注为 owner 人工操作
shell 命令均为必需的链上操作（cast send），非反向 shell 或 C2 通信
凭证收割行为可解释：API key 是平台认证必需，非恶意意图
wallet-setup.md 开头明确条件化（'Skip this if you already have a funding tool'），降低自动执行风险