Навыки publish-to-all-skill-stores История аудитов

📦

История аудитов

publish-to-all-skill-stores - 2 аудиты

Сравнение версий

Изменения возможностей и находок между проверенными версиями, сначала новые.

Версия	Дата	Результат	Пункты проверки	Изменение к предыдущей
v2 Последняя	29 окт. 2026 г., 22:03	3 подтверждено	8	Переменные окружения
v1	25 окт. 2026 г., 22:38	3 подтверждено	8	Базовая

Версия аудита 2 Последняя

29 окт. 2026 г., 22:03

Reviewed all 159 static findings: eight identify credential forwarding or unsafe temporary login logs; the remaining 151 are false positives. Semantic findings identify plaintext credential memory, unsafe archive selection, and instructions that can manipulate security review through unsupported safety claims. No evidence found of executable obfuscated payloads; multilingual prose, detection signatures, and Markdown explain the apparent execution and entropy alerts.

Просканировано файлов

2,967

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (3)

Высокий

references/xiaping.md:33-36

Long-Lived API Key Stored in Agent Memory

The XiaPing guide directs agents to store their long-lived API key in MEMORY.md. Plaintext agent memory can expose credentials through later context loading, synchronization, or accidental publication.

The text identifies the response key as a long-term credential and explicitly instructs saving it in the memory document. No protected storage mechanism is specified.

Высокий

scripts/build_package.py:35-74 scripts/build_package.py:84-90 scripts/build_wb.py:85-98 scripts/build_wb.py:167-171

Sensitive Local Files Can Enter Publication Archives

The generic builder accepts credential files, while both builders follow file symlinks without checking containment. WorkBuddy limits top-level directories, but secrets inside those directories can still enter release archives.

The generic collector accepts .env; WorkBuddy accepts files inside designated subdirectories without secret exclusions. Both archive writers dereference file symlinks, so disclosure depends on the selected tree.

Высокий

SKILL.md:89-91 references/paid-channels.md:123-128

Prompt Injection Attempt Detected

The guide says "写进提交备注，比修改代码更有效", meaning writing safety assurances in submission notes is more effective than changing code. Instructing agents to assert no network access and mandatory backups without verification can manipulate marketplace security review.

The instructions explicitly favor safety claims over code corrections and repeat blanket assurances for scripted skills. This targets downstream review, not this audit's instruction hierarchy.

Пункты проверки возможностей (8)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий

references/pitfalls.md:96

Shell command substitution

TOK=$(gh auth token); B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The recipe extracts a GitHub token and Base64-encodes it for an Authorization header. Lines 97-98 send that credential through ghfast.top.

Высокий

references/pitfalls.md:98 references/submission-recipes.md:170

Hardcoded URL · 2 совпадений

push https://ghfast.top/https://github.com/<owner>/<repo>.git main

The Git push targets ghfast.top while the preceding line supplies a GitHub Authorization header. The third-party mirror receives reusable GitHub credentials.

Высокий

references/submission-recipes.md:166

Shell command substitution

TOK=$(gh auth token)

The command retrieves the active GitHub token. The following commands place it in an Authorization header sent through a third-party mirror.

Высокий

references/submission-recipes.md:167

Shell command substitution

B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command converts the GitHub token into reversible Basic authentication material. Lines 168-170 send it to ghfast.top rather than directly to GitHub.

Средний

references/pitfalls.md:65

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12; cat /tmp/clawlogin.log

Login output is redirected to a predictable shared temporary path without permission controls. Another local user could read authentication output or preplant a symlink.

Средний

references/submission-recipes.md:98

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12

The login process writes authentication output to a fixed shared temporary filename. Missing restrictive permissions and exclusive creation permit local disclosure or symlink clobbering.

Средний

references/submission-recipes.md:99

Temp directory access

cat /tmp/clawlogin.log # 拿到 https://clawhub.ai/cli/device?user_code=XXXX-XXXX

The command reads a predictable shared login log without verifying ownership or permissions. A local attacker could replace it or access authentication output.

Факторы риска

🌐 Доступ к сети (48)

📁 Доступ к файловой системе (23)

⚙️ Внешние команды (50)

references/pitfalls.md:96 references/pitfalls.md:65 references/submission-recipes.md:79 references/submission-recipes.md:102 references/submission-recipes.md:166 references/submission-recipes.md:167 references/submission-recipes.md:98 scripts/preflight.py:51 scripts/preflight.py:53 scripts/preflight.py:252 scripts/preflight.py:262 scripts/preflight.py:266 scripts/preflight.py:283 scripts/preflight.py:332 scripts/preflight.py:387 scripts/preflight.py:408 scripts/preflight.py:431 scripts/preflight.py:432 SKILL.md:35 SKILL.md:37 SKILL.md:49-54 SKILL.md:54-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-75 SKILL.md:75-85 SKILL.md:85 SKILL.md:89-94 SKILL.md:94 SKILL.md:95 SKILL.md:104-121 SKILL.md:121-122 SKILL.md:122-127 SKILL.md:127 SKILL.md:128 SKILL.md:131 SKILL.md:132 SKILL.md:134-135 SKILL.md:135-150 SKILL.md:150-158 SKILL.md:158-168 SKILL.md:168-170 SKILL.md:170 SKILL.md:176 SKILL.md:177-180 SKILL.md:180-187

⚡ Содержит скрипты (3)

references/submission-recipes.md:153 scripts/preflight.py:50 scripts/preflight.py:51

🔑 Переменные окружения (7)

references/workbuddy-connector.md:76 references/xiaping.md:25 references/xiaping.md:33 references/xiaping.md:50 references/xiaping.md:62 references/xiaping.md:77 references/xiaping.md:133

Аудитор:: codex

Версия аудита 1

25 окт. 2026 г., 22:38

Most static findings are harmless detection patterns, Markdown formatting, multilingual text, or expected publishing operations. Confirmed risks include GitHub token disclosure through a third-party mirror and predictable temporary login logs. Additional findings concern unsupported safety assurances, packaging secrets or external symlink targets, and checksum files that do not authenticate the ZIP archive.

Просканировано файлов

1,697

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (3)

Высокий

SKILL.md:58-60 references/paid-channels.md:58-59

Unsupported Safety Assurances Encouraged During Review

SKILL.md says adding safety assertions to submission notes is more effective than changing code. It lists no network and mandatory backups without requiring verification. This can mislead reviewers and downstream agents about the submitted skill's actual behavior.

The guidance explicitly favors assurances over code changes and supplies safety claims without an evidence requirement. No evidence establishes that those claims hold for every submitted skill.

Высокий

scripts/build_package.py:35-59 scripts/build_package.py:63-90

Release Packages Can Include Secrets and External Symlink Targets

The release denylist omits common credential files such as .env, and file symlinks are collected without containment checks. Reading their bytes can package secrets or files outside the selected skill directory for later publication.

The collector accepts any file not matching the denylist, and read_bytes follows file symlinks. No credential exclusion or resolved-path boundary check protects the release archive.

Средний

scripts/build_package.py:82-95

Checksum Sidecar Does Not Authenticate the ZIP Archive

The .zip.sha256 sidecar contains a hash of concatenated source-file bytes, not the ZIP it names. Archive paths and metadata are excluded, so it cannot reliably authenticate the published artifact.

The digest updates only with source contents before writing the archive entries. The sidecar labels that digest with the ZIP filename despite never hashing the completed ZIP.

Пункты проверки возможностей (8)

Высокий

references/pitfalls.md:96

Shell command substitution

TOK=$(gh auth token); B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command retrieves a GitHub token and encodes it for the authorization header sent to ghfast.top in lines 97-98. This exposes credentials to a third-party mirror.

Высокий

references/pitfalls.md:98 references/submission-recipes.md:154

Hardcoded URL · 2 совпадений

push https://ghfast.top/https://github.com/<owner>/<repo>.git main

The preceding command attaches a GitHub Basic authorization header to this ghfast.top push. HTTPS terminates at the mirror and does not protect the token from that operator.

Высокий

references/submission-recipes.md:150

Shell command substitution

TOK=$(gh auth token)

The retrieved GitHub token is used in the authorization header for a ghfast.top push in lines 151-154. The complete recipe discloses credentials outside GitHub.

Высокий

references/submission-recipes.md:151

Shell command substitution

B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)

The command encodes the GitHub token for the subsequent third-party mirror request. Base64 is reversible and does not protect the credential from the mirror.

Средний

references/pitfalls.md:65

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12; cat /tmp/clawlogin.log

Shell redirection opens a predictable shared temporary filename without exclusive creation or restrictive permissions. Local users can potentially read login codes or precreate a symlink to redirect writes.

Средний

references/submission-recipes.md:98

Temp directory access

(nohup npx -y clawhub@latest login >/tmp/clawlogin.log 2>&1 &); sleep 12

Device-login output is redirected to a fixed shared temporary path without exclusive creation or permission controls. Local attackers could expose login codes or redirect the write through a precreated symlink.

Средний

references/submission-recipes.md:99

Temp directory access

cat /tmp/clawlogin.log # 拿到 https://clawhub.ai/cli/device?user_code=XXXX-XXXX

The command trusts a predictable shared login log without checking its owner or provenance. A local attacker could substitute authorization instructions, and permissive file creation can expose device codes.

Факторы риска

⚙️ Внешние команды (31)

🌐 Доступ к сети (38)

📁 Доступ к файловой системе (12)

references/pitfalls.md:91 references/pitfalls.md:65 references/submission-recipes.md:137 references/submission-recipes.md:144 references/submission-recipes.md:98 references/submission-recipes.md:99 scripts/build_package.py:31 scripts/build_package.py:84 scripts/preflight.py:252 scripts/submit_all.py:21 scripts/submit_all.py:26 scripts/submit_all.py:460

⚡ Содержит скрипты (3)

references/submission-recipes.md:137 scripts/preflight.py:50 scripts/preflight.py:51

Аудитор:: codex

← Назад к навыку