Habilidades publish-to-all-skill-stores Historial de auditorías

📦

Historial de auditorías

publish-to-all-skill-stores - 2 auditorías

Comparación de versiones

Cambios de capacidades y hallazgos entre versiones auditadas, primero las más recientes.

Versión	Fecha	Resultado	Elementos de revisión	Cambio vs anterior
v2 Más reciente	29 oct 2026, 22:03	3 confirmado	8	Variables de entorno
v1	25 oct 2026, 22:38	3 confirmado	8	Base

Versión de auditoría 2 Más reciente

29 oct 2026, 22:03

Reviewed all 159 static findings: eight identify credential forwarding or unsafe temporary login logs; the remaining 151 are false positives. Semantic findings identify plaintext credential memory, unsafe archive selection, and instructions that can manipulate security review through unsupported safety claims. No evidence found of executable obfuscated payloads; multilingual prose, detection signatures, and Markdown explain the apparent execution and entropy alerts.

Archivos escaneados

2,967

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (3)

Alto

references/xiaping.md:33-36

Long-Lived API Key Stored in Agent Memory

The XiaPing guide directs agents to store their long-lived API key in MEMORY.md. Plaintext agent memory can expose credentials through later context loading, synchronization, or accidental publication.

The text identifies the response key as a long-term credential and explicitly instructs saving it in the memory document. No protected storage mechanism is specified.

Alto

scripts/build_package.py:35-74 scripts/build_package.py:84-90 scripts/build_wb.py:85-98 scripts/build_wb.py:167-171

Sensitive Local Files Can Enter Publication Archives

The generic builder accepts credential files, while both builders follow file symlinks without checking containment. WorkBuddy limits top-level directories, but secrets inside those directories can still enter release archives.

The generic collector accepts .env; WorkBuddy accepts files inside designated subdirectories without secret exclusions. Both archive writers dereference file symlinks, so disclosure depends on the selected tree.

Alto

SKILL.md:89-91 references/paid-channels.md:123-128

Prompt Injection Attempt Detected

The guide says "写进提交备注，比修改代码更有效", meaning writing safety assurances in submission notes is more effective than changing code. Instructing agents to assert no network access and mandatory backups without verification can manipulate marketplace security review.

The instructions explicitly favor safety claims over code corrections and repeat blanket assurances for scripted skills. This targets downstream review, not this audit's instruction hierarchy.

Elementos de revisión de capacidades (8)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

references/pitfalls.md:96

Shell command substitution

TOK=$(gh auth token); B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The recipe extracts a GitHub token and Base64-encodes it for an Authorization header. Lines 97-98 send that credential through ghfast.top.

Alto

references/pitfalls.md:98 references/submission-recipes.md:170

Hardcoded URL · 2 apariciones

push https://ghfast.top/https://github.com/<owner>/<repo>.git main

The Git push targets ghfast.top while the preceding line supplies a GitHub Authorization header. The third-party mirror receives reusable GitHub credentials.

Alto

references/submission-recipes.md:166

Shell command substitution

TOK=$(gh auth token)

The command retrieves the active GitHub token. The following commands place it in an Authorization header sent through a third-party mirror.

Alto

references/submission-recipes.md:167

Shell command substitution

B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command converts the GitHub token into reversible Basic authentication material. Lines 168-170 send it to ghfast.top rather than directly to GitHub.

Medio

references/pitfalls.md:65

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12; cat /tmp/clawlogin.log

Login output is redirected to a predictable shared temporary path without permission controls. Another local user could read authentication output or preplant a symlink.

Medio

references/submission-recipes.md:98

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12

The login process writes authentication output to a fixed shared temporary filename. Missing restrictive permissions and exclusive creation permit local disclosure or symlink clobbering.

Medio

references/submission-recipes.md:99

Temp directory access

cat /tmp/clawlogin.log # 拿到 https://clawhub.ai/cli/device?user_code=XXXX-XXXX

The command reads a predictable shared login log without verifying ownership or permissions. A local attacker could replace it or access authentication output.

Factores de riesgo

🌐 Acceso a red (48)

📁 Acceso al sistema de archivos (23)

⚙️ Comandos externos (50)

references/pitfalls.md:96 references/pitfalls.md:65 references/submission-recipes.md:79 references/submission-recipes.md:102 references/submission-recipes.md:166 references/submission-recipes.md:167 references/submission-recipes.md:98 scripts/preflight.py:51 scripts/preflight.py:53 scripts/preflight.py:252 scripts/preflight.py:262 scripts/preflight.py:266 scripts/preflight.py:283 scripts/preflight.py:332 scripts/preflight.py:387 scripts/preflight.py:408 scripts/preflight.py:431 scripts/preflight.py:432 SKILL.md:35 SKILL.md:37 SKILL.md:49-54 SKILL.md:54-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-75 SKILL.md:75-85 SKILL.md:85 SKILL.md:89-94 SKILL.md:94 SKILL.md:95 SKILL.md:104-121 SKILL.md:121-122 SKILL.md:122-127 SKILL.md:127 SKILL.md:128 SKILL.md:131 SKILL.md:132 SKILL.md:134-135 SKILL.md:135-150 SKILL.md:150-158 SKILL.md:158-168 SKILL.md:168-170 SKILL.md:170 SKILL.md:176 SKILL.md:177-180 SKILL.md:180-187

⚡ Contiene scripts (3)

references/submission-recipes.md:153 scripts/preflight.py:50 scripts/preflight.py:51

🔑 Variables de entorno (7)

references/workbuddy-connector.md:76 references/xiaping.md:25 references/xiaping.md:33 references/xiaping.md:50 references/xiaping.md:62 references/xiaping.md:77 references/xiaping.md:133

Auditado por: codex

Versión de auditoría 1

25 oct 2026, 22:38

Most static findings are harmless detection patterns, Markdown formatting, multilingual text, or expected publishing operations. Confirmed risks include GitHub token disclosure through a third-party mirror and predictable temporary login logs. Additional findings concern unsupported safety assurances, packaging secrets or external symlink targets, and checksum files that do not authenticate the ZIP archive.

Archivos escaneados

1,697

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (3)

Alto

SKILL.md:58-60 references/paid-channels.md:58-59

Unsupported Safety Assurances Encouraged During Review

SKILL.md says adding safety assertions to submission notes is more effective than changing code. It lists no network and mandatory backups without requiring verification. This can mislead reviewers and downstream agents about the submitted skill's actual behavior.

The guidance explicitly favors assurances over code changes and supplies safety claims without an evidence requirement. No evidence establishes that those claims hold for every submitted skill.

Alto

scripts/build_package.py:35-59 scripts/build_package.py:63-90

Release Packages Can Include Secrets and External Symlink Targets

The release denylist omits common credential files such as .env, and file symlinks are collected without containment checks. Reading their bytes can package secrets or files outside the selected skill directory for later publication.

The collector accepts any file not matching the denylist, and read_bytes follows file symlinks. No credential exclusion or resolved-path boundary check protects the release archive.

Medio

scripts/build_package.py:82-95

Checksum Sidecar Does Not Authenticate the ZIP Archive

The .zip.sha256 sidecar contains a hash of concatenated source-file bytes, not the ZIP it names. Archive paths and metadata are excluded, so it cannot reliably authenticate the published artifact.

The digest updates only with source contents before writing the archive entries. The sidecar labels that digest with the ZIP filename despite never hashing the completed ZIP.

Elementos de revisión de capacidades (8)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

references/pitfalls.md:96

Shell command substitution

TOK=$(gh auth token); B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command retrieves a GitHub token and encodes it for the authorization header sent to ghfast.top in lines 97-98. This exposes credentials to a third-party mirror.

Alto

references/pitfalls.md:98 references/submission-recipes.md:154

Hardcoded URL · 2 apariciones

push https://ghfast.top/https://github.com/<owner>/<repo>.git main

The preceding command attaches a GitHub Basic authorization header to this ghfast.top push. HTTPS terminates at the mirror and does not protect the token from that operator.

Alto

references/submission-recipes.md:150

Shell command substitution

TOK=$(gh auth token)

The retrieved GitHub token is used in the authorization header for a ghfast.top push in lines 151-154. The complete recipe discloses credentials outside GitHub.

Alto

references/submission-recipes.md:151

Shell command substitution

B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command encodes the GitHub token for the subsequent third-party mirror request. Base64 is reversible and does not protect the credential from the mirror.

Medio

references/pitfalls.md:65

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12; cat /tmp/clawlogin.log

Shell redirection opens a predictable shared temporary filename without exclusive creation or restrictive permissions. Local users can potentially read login codes or precreate a symlink to redirect writes.

Medio

references/submission-recipes.md:98

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12

Device-login output is redirected to a fixed shared temporary path without exclusive creation or permission controls. Local attackers could expose login codes or redirect the write through a precreated symlink.

Medio

references/submission-recipes.md:99

Temp directory access

cat /tmp/clawlogin.log # 拿到 https://clawhub.ai/cli/device?user_code=XXXX-XXXX

The command trusts a predictable shared login log without checking its owner or provenance. A local attacker could substitute authorization instructions, and permissive file creation can expose device codes.

Factores de riesgo

⚙️ Comandos externos (31)

🌐 Acceso a red (38)

📁 Acceso al sistema de archivos (12)

references/pitfalls.md:91 references/pitfalls.md:65 references/submission-recipes.md:137 references/submission-recipes.md:144 references/submission-recipes.md:98 references/submission-recipes.md:99 scripts/build_package.py:31 scripts/build_package.py:84 scripts/preflight.py:252 scripts/submit_all.py:21 scripts/submit_all.py:26 scripts/submit_all.py:460

⚡ Contiene scripts (3)

references/submission-recipes.md:137 scripts/preflight.py:50 scripts/preflight.py:51

Auditado por: codex

← Volver a la habilidad