中文 EN
Start Review
Skill Trust Decision

video-content-pipeline

技能包内置伪造CA证书配合硬编码恶意IP地址，构成中间人攻击工具链，API密钥将被发送至攻击者控制的服务器。

Install decision first Source: ClawHub Scanned: 20 days ago
Files 7
Artifacts 6
Violations 2
Findings 4
Most direct threat evidence
Critical Obfuscation
伪造CA证书内置于技能包

northcap-ca.pem 是使用硬编码IP(186.240.156.169)作为Subject和Issuer的CA证书。正常CA证书绝不使用IP，这是不存在可信根CA的反向代理/MITM工具。

scripts/northcap-ca.pem:10

Why this conclusion was reached

3/4 dimensions flagged
Block
Declared vs actual capability

2 undeclared or violating capabilities were inferred.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 4 attack-chain steps and 4 severe findings.

Review
Dependencies and supply chain hygiene

2 dependency or supply-chain issues need attention.

Attack Chain

01
用户通过 SKILL.md 了解技能，误以为使用 x402 支付API

Entry · SKILL.md:1

02
伪造CA证书(northcap-ca.pem)用于拦截加密流量

Escalation · scripts/northcap-ca.pem:1

03
API密钥被POST到攻击者控制的 186.240.156.169:8791

Escalation · scripts/scene_gen.py:28

04
攻击者窃取 X402_API_KEY 完成凭证收割

Impact · scripts/scene_gen.py:28

What drove the risk score up

伪造CA证书 +30

northcap-ca.pem 使用IP而非域名作为Subject/Issuer，是典型MITM工具

硬编码恶意IP +25

scene_gen.py 硬编码 186.240.156.169:8791，注释禁止环境变量覆盖

API密钥外泄 +23

X402_API_KEY 将被POST到攻击者控制的服务

Most important evidence

Critical Obfuscation

伪造CA证书内置于技能包

northcap-ca.pem 是使用硬编码IP(186.240.156.169)作为Subject和Issuer的CA证书。正常CA证书绝不使用IP，这是不存在可信根CA的反向代理/MITM工具。

scripts/northcap-ca.pem:10
立即删除该证书文件，调查是否已导入系统信任存储
Critical Credential Theft

API密钥将POST至恶意服务器

scene_gen.py 硬编码 BASE='https://186.240.156.169:8791'，用户输入的 X402_API_KEY 将通过 x-api-key header 发送至攻击者控制的服务器。

scripts/scene_gen.py:8
封禁该IP地址，禁止使用该技能
Critical Doc Mismatch

文档声称可配置环境变量但代码强制锁定

代码注释明确写道'ingen env-override'(不允许环境变量覆盖)，公然欺骗声称允许配置的SKILL.md文档。

scripts/scene_gen.py:8
该技能存在系统性欺骗行为
High Sensitive Access

敏感IOC: 硬编码IP地址

186.240.156.169:8791 作为硬编码BASE URL，用户无法修改或审查请求目的地。

SKILL.md:4
检查该IP是否在威胁情报库中

Declared capability vs actual capability

Filesystem Pass
Declared READ
→
Inferred WRITE
compositor.py:16 创建/tmp临时文件
Network Block
Declared READ
→
Inferred WRITE
scene_gen.py:8 POST请求到硬编码IP
Shell Block
Declared NONE
→
Inferred WRITE
compositor.py:18 调用ffmpeg subprocess

Suspicious artifacts and egress

High IP Address
186.240.156.169

SKILL.md:4

Medium External URL
https://186.240.156.169:8791

SKILL.md:4

Medium External URL
https://image.pollinations.ai

SKILL.md:4

Medium External URL
https://speech.platform.bing.com

SKILL.md:4

Medium Wallet Address
0xafd1c6bC2B35152f30E3D0dBE99eE1d40E5a5CF8

SKILL.md:71

Medium External URL
https://image.pollinations.ai/prompt/

scripts/generate_images.py:18

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
edge-tts * pip No 无版本锁定
Pillow * pip No 无版本锁定

File composition

7 files · 265 lines
Python 5 files · 170 linesMarkdown 1 files · 75 linesOther 1 files · 20 lines
Files of concern · 4
scripts/northcap-ca.pem Other · 20 lines
伪造CA证书内置于技能包
SKILL.md Markdown · 75 lines
敏感IOC: 硬编码IP地址 · 186.240.156.169 · https://186.240.156.169:8791 · https://image.pollinations.ai · https://speech.platform.bing.com · 0xafd1c6bC2B35152f30E3D0dBE99eE1d40E5a5CF8
scripts/scene_gen.py Python · 49 lines
API密钥将POST至恶意服务器 · 文档声称可配置环境变量但代码强制锁定
scripts/generate_images.py Python · 29 lines
https://image.pollinations.ai/prompt/
Other files · compositor.py · voiceover.py · scene_plan.py

Security positives

image.pollinations.ai 是知名的开源图像生成服务
edge_tts 调用微软官方Edge TTS服务
ffmpeg 使用标准CLI工具完成视频合成