Fähigkeiten publish-to-all-skill-stores Audit-Verlauf

📦

Audit-Verlauf

publish-to-all-skill-stores - 2 Audits

Versionsvergleich

Änderungen an Fähigkeiten und Befunden über geprüfte Versionen hinweg, neueste zuerst.

Version	Datum	Ergebnis	Prüfelemente	Änderung ggü. vorheriger
v2 Neueste	29. Okt. 2026, 22:03	3 bestätigt	8	Umgebungsvariablen
v1	25. Okt. 2026, 22:38	3 bestätigt	8	Ausgangsbasis

Audit-Version 2 Neueste

29. Okt. 2026, 22:03

Reviewed all 159 static findings: eight identify credential forwarding or unsafe temporary login logs; the remaining 151 are false positives. Semantic findings identify plaintext credential memory, unsafe archive selection, and instructions that can manipulate security review through unsupported safety claims. No evidence found of executable obfuscated payloads; multilingual prose, detection signatures, and Markdown explain the apparent execution and entropy alerts.

Gescannte Dateien

2,967

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (3)

Hoch

references/xiaping.md:33-36

Long-Lived API Key Stored in Agent Memory

The XiaPing guide directs agents to store their long-lived API key in MEMORY.md. Plaintext agent memory can expose credentials through later context loading, synchronization, or accidental publication.

The text identifies the response key as a long-term credential and explicitly instructs saving it in the memory document. No protected storage mechanism is specified.

Hoch

scripts/build_package.py:35-74 scripts/build_package.py:84-90 scripts/build_wb.py:85-98 scripts/build_wb.py:167-171

Sensitive Local Files Can Enter Publication Archives

The generic builder accepts credential files, while both builders follow file symlinks without checking containment. WorkBuddy limits top-level directories, but secrets inside those directories can still enter release archives.

The generic collector accepts .env; WorkBuddy accepts files inside designated subdirectories without secret exclusions. Both archive writers dereference file symlinks, so disclosure depends on the selected tree.

Hoch

SKILL.md:89-91 references/paid-channels.md:123-128

Prompt Injection Attempt Detected

The guide says "写进提交备注，比修改代码更有效", meaning writing safety assurances in submission notes is more effective than changing code. Instructing agents to assert no network access and mandatory backups without verification can manipulate marketplace security review.

The instructions explicitly favor safety claims over code corrections and repeat blanket assurances for scripted skills. This targets downstream review, not this audit's instruction hierarchy.

Elemente der Fähigkeitsprüfung (8)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

references/pitfalls.md:96

Shell command substitution

TOK=$(gh auth token); B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The recipe extracts a GitHub token and Base64-encodes it for an Authorization header. Lines 97-98 send that credential through ghfast.top.

Hoch

references/pitfalls.md:98 references/submission-recipes.md:170

Hardcoded URL · 2 Vorkommen

push https://ghfast.top/https://github.com/<owner>/<repo>.git main

The Git push targets ghfast.top while the preceding line supplies a GitHub Authorization header. The third-party mirror receives reusable GitHub credentials.

Hoch

references/submission-recipes.md:166

Shell command substitution

TOK=$(gh auth token)

The command retrieves the active GitHub token. The following commands place it in an Authorization header sent through a third-party mirror.

Hoch

references/submission-recipes.md:167

Shell command substitution

B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command converts the GitHub token into reversible Basic authentication material. Lines 168-170 send it to ghfast.top rather than directly to GitHub.

Mittel

references/pitfalls.md:65

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12; cat /tmp/clawlogin.log

Login output is redirected to a predictable shared temporary path without permission controls. Another local user could read authentication output or preplant a symlink.

Mittel

references/submission-recipes.md:98

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12

The login process writes authentication output to a fixed shared temporary filename. Missing restrictive permissions and exclusive creation permit local disclosure or symlink clobbering.

Mittel

references/submission-recipes.md:99

Temp directory access

cat /tmp/clawlogin.log # 拿到 https://clawhub.ai/cli/device?user_code=XXXX-XXXX

The command reads a predictable shared login log without verifying ownership or permissions. A local attacker could replace it or access authentication output.

Risikofaktoren

🌐 Netzwerkzugriff (48)

📁 Dateisystemzugriff (23)

⚙️ Externe Befehle (50)

references/pitfalls.md:96 references/pitfalls.md:65 references/submission-recipes.md:79 references/submission-recipes.md:102 references/submission-recipes.md:166 references/submission-recipes.md:167 references/submission-recipes.md:98 scripts/preflight.py:51 scripts/preflight.py:53 scripts/preflight.py:252 scripts/preflight.py:262 scripts/preflight.py:266 scripts/preflight.py:283 scripts/preflight.py:332 scripts/preflight.py:387 scripts/preflight.py:408 scripts/preflight.py:431 scripts/preflight.py:432 SKILL.md:35 SKILL.md:37 SKILL.md:49-54 SKILL.md:54-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-75 SKILL.md:75-85 SKILL.md:85 SKILL.md:89-94 SKILL.md:94 SKILL.md:95 SKILL.md:104-121 SKILL.md:121-122 SKILL.md:122-127 SKILL.md:127 SKILL.md:128 SKILL.md:131 SKILL.md:132 SKILL.md:134-135 SKILL.md:135-150 SKILL.md:150-158 SKILL.md:158-168 SKILL.md:168-170 SKILL.md:170 SKILL.md:176 SKILL.md:177-180 SKILL.md:180-187

⚡ Enthält Skripte (3)

references/submission-recipes.md:153 scripts/preflight.py:50 scripts/preflight.py:51

🔑 Umgebungsvariablen (7)

references/workbuddy-connector.md:76 references/xiaping.md:25 references/xiaping.md:33 references/xiaping.md:50 references/xiaping.md:62 references/xiaping.md:77 references/xiaping.md:133

Geprüft von: codex

Audit-Version 1

25. Okt. 2026, 22:38

Most static findings are harmless detection patterns, Markdown formatting, multilingual text, or expected publishing operations. Confirmed risks include GitHub token disclosure through a third-party mirror and predictable temporary login logs. Additional findings concern unsupported safety assurances, packaging secrets or external symlink targets, and checksum files that do not authenticate the ZIP archive.

Gescannte Dateien

1,697

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (3)

Hoch

SKILL.md:58-60 references/paid-channels.md:58-59

Unsupported Safety Assurances Encouraged During Review

SKILL.md says adding safety assertions to submission notes is more effective than changing code. It lists no network and mandatory backups without requiring verification. This can mislead reviewers and downstream agents about the submitted skill's actual behavior.

The guidance explicitly favors assurances over code changes and supplies safety claims without an evidence requirement. No evidence establishes that those claims hold for every submitted skill.

Hoch

scripts/build_package.py:35-59 scripts/build_package.py:63-90

Release Packages Can Include Secrets and External Symlink Targets

The release denylist omits common credential files such as .env, and file symlinks are collected without containment checks. Reading their bytes can package secrets or files outside the selected skill directory for later publication.

The collector accepts any file not matching the denylist, and read_bytes follows file symlinks. No credential exclusion or resolved-path boundary check protects the release archive.

Mittel

scripts/build_package.py:82-95

Checksum Sidecar Does Not Authenticate the ZIP Archive

The .zip.sha256 sidecar contains a hash of concatenated source-file bytes, not the ZIP it names. Archive paths and metadata are excluded, so it cannot reliably authenticate the published artifact.

The digest updates only with source contents before writing the archive entries. The sidecar labels that digest with the ZIP filename despite never hashing the completed ZIP.

Elemente der Fähigkeitsprüfung (8)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

references/pitfalls.md:96

Shell command substitution

TOK=$(gh auth token); B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command retrieves a GitHub token and encodes it for the authorization header sent to ghfast.top in lines 97-98. This exposes credentials to a third-party mirror.

Hoch

references/pitfalls.md:98 references/submission-recipes.md:154

Hardcoded URL · 2 Vorkommen

push https://ghfast.top/https://github.com/<owner>/<repo>.git main

The preceding command attaches a GitHub Basic authorization header to this ghfast.top push. HTTPS terminates at the mirror and does not protect the token from that operator.

Hoch

references/submission-recipes.md:150

Shell command substitution

TOK=$(gh auth token)

The retrieved GitHub token is used in the authorization header for a ghfast.top push in lines 151-154. The complete recipe discloses credentials outside GitHub.

Hoch

references/submission-recipes.md:151

Shell command substitution

B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command encodes the GitHub token for the subsequent third-party mirror request. Base64 is reversible and does not protect the credential from the mirror.

Mittel

references/pitfalls.md:65

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12; cat /tmp/clawlogin.log

Shell redirection opens a predictable shared temporary filename without exclusive creation or restrictive permissions. Local users can potentially read login codes or precreate a symlink to redirect writes.

Mittel

references/submission-recipes.md:98

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12

Device-login output is redirected to a fixed shared temporary path without exclusive creation or permission controls. Local attackers could expose login codes or redirect the write through a precreated symlink.

Mittel

references/submission-recipes.md:99

Temp directory access

cat /tmp/clawlogin.log # 拿到 https://clawhub.ai/cli/device?user_code=XXXX-XXXX

The command trusts a predictable shared login log without checking its owner or provenance. A local attacker could substitute authorization instructions, and permissive file creation can expose device codes.

Risikofaktoren

⚙️ Externe Befehle (31)

🌐 Netzwerkzugriff (38)

📁 Dateisystemzugriff (12)

references/pitfalls.md:91 references/pitfalls.md:65 references/submission-recipes.md:137 references/submission-recipes.md:144 references/submission-recipes.md:98 references/submission-recipes.md:99 scripts/build_package.py:31 scripts/build_package.py:84 scripts/preflight.py:252 scripts/submit_all.py:21 scripts/submit_all.py:26 scripts/submit_all.py:460

⚡ Enthält Skripte (3)

references/submission-recipes.md:137 scripts/preflight.py:50 scripts/preflight.py:51

Geprüft von: codex

← Zurück zum Skill