Docker官网镜像拉取能力

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:15 AM UTC
• Version: 0.3.0

Overview

The skill's Docker image sync purpose is coherent, but it asks OpenClaw to handle and persist powerful GitHub and CNB tokens in risky ways.

Review before installing. Prefer gh auth login and do not paste GitHub or CNB tokens into chat. If you use this skill, create short-lived, narrowly scoped tokens, avoid broad repo tokens, store secrets outside shared plaintext files when possible, rotate any token previously pasted into OpenClaw, and inspect the pushed GitHub Actions workflow before running it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:274
• Finding: Insecure Collection and Broad Plaintext Storage of Access Tokens<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:274-285`; `cnb-pull.sh:31-60` **Vulnerability Type**: Plaintext secret collection, shared credential storage, and unnecessarily broad environment-variable exposure **Risk Level**: High ### Vulnerable Code `SKILL.md:274-285`: ```markdown ### Step 3 — Provide Parameters to openclaw Reply with these 4 values: | Parameter | Description | Example | |-----------|-------------|---------| | `CNB_TOKEN` | CNB access token | `8B76Bopie1d966fVDMgJnhFRepZ` | | `CNB_REGISTRY` | CNB registry address (fixed value) | `docker.cnb.cool` | | `CNB_REPO_SLUG` | CNB namespace (lowercase) | `lufei123/lufei-docker` | | `CNB_GITHUB_REPO` | Private repo address (format: `your-github-username/cnb-docker-sync`) | `your-github-username/cnb-docker-sync` | **openclaw will automatically:** 1. Write to `~/.openclaw/.env` (please keep this file trusted — run `chmod 600 ~/.openclaw/.env`) ``` `cnb-pull.sh:31-60`: ```bash local env_file="$HOME/.openclaw/.env" if [[ ! -f "$env_file" ]]; then return 0 fi while IFS= read -r line || [[ -n "$line" ]]; do [[ "$line" =~ ^# ]] && continue [[ -z "${line// }" ]] && continue if [[ "$line" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; then local key="${line%%=*}" case "$key" in CNB_TOKEN|CNB_REGISTRY|CNB_REPO_SLUG|CNB_GITHUB_REPO|GITHUB_TOKEN) local val="${line#*=}" val="${val//\"/}" val="${val//\'/}" val="${val#"${val%%[![:space:]]*}"}" val="${val%"${val##*[![:space:]]}"}" export "$key"="$val" ;; esac fi done < "$env_file" ``` ### Technical Analysis The Skill explicitly instructs users to submit `CNB_TOKEN` through the Agent conversation and states that the credential will be written to the shared `~/.openclaw/.env` file. This creates multiple unnec ...[truncated 2336 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to submit access tokens through chat or Agent messages. 2. Collect secrets directly in a trusted terminal using hidden input, such as `read -rs`, or through the provider's authenticated device flow. 3. Prefer `gh auth login` and GitHub CLI credential management instead of requiring `GITHUB_TOKEN` in the OpenClaw environment file. 4. Store the CNB token in an operating-system keychain or a dedicated Skill-specific secret store. 5. If file storage is unavoidable: - Create a dedicated file with `umask 077`. - Enforce mode `0600`. - Verify that the current user owns the file. - Reject symlinks and files with group or world permissions. 6. Do not export credentials globally. Supply each credential only to the exact command that needs it, preferably through standard input. 7. Document the exact minimum CNB permissions required and require a short-lived, registry-restricted token. 8. Advise users who previously followed the instructions to rotate any token submitted through chat. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: cnb-pull.sh:180
• Finding: GitHub Token Exposed Through Clone URLs and Temporary Git Metadata<![CDATA[ ## Vulnerability Details **File Location**: `cnb-pull.sh:180-192` and `cnb-pull.sh:265-281` **Vulnerability Type**: Credential disclosure through command arguments and temporary repository configuration **Risk Level**: High ### Vulnerable Code `cnb-pull.sh:180-192`: ```bash local WORKFLOW_DIR="${SCRIPT_DIR}/workflow" if [[ -d "$WORKFLOW_DIR" ]]; then info "推送内嵌 workflow 到 ${REPO_FULL}..." TEMP_DIR=$(mktemp -d) git clone --depth 1 "https://x-access-token:${GITHUB_TOKEN}@github.com/${REPO_FULL}.git" "$TEMP_DIR" 2>/dev/null mkdir -p "$TEMP_DIR/.github/workflows" cp "$WORKFLOW_DIR"/docker-image-sync.yml "$TEMP_DIR/.github/workflows/docker-image-sync.yml" cd "$TEMP_DIR" git config user.email "automation@openclaw" git config user.name "OpenClaw CNB Sync" git add . ``` `cnb-pull.sh:265-281`: ```bash GH_USER=$(gh api user --jq '.login' 2>&1) REPO_NAME="cnb-docker-sync" REPO_FULL="${GH_USER}/${REPO_NAME}" local GIT_TOKEN="${GITHUB_TOKEN}" TEMP_DIR=$(mktemp -d) info "克隆仓库（私有仓库）..." git clone --depth 1 --branch main "https://x-access-token:${GIT_TOKEN}@github.com/${REPO_FULL}.git" "$TEMP_DIR" 2>/dev/null echo "${REMOTE_IMAGE}:${REMOTE_TAG}" > "$TEMP_DIR/$IMAGES_FILE" info "更新 images.txt: ${REMOTE_IMAGE}:${REMOTE_TAG}" cd "$TEMP_DIR" git config user.email "automation@openclaw" git config user.name "OpenClaw CNB Sync" git add "$IMAGES_FILE" git commit -m "代理同步: ${REMOTE_IMAGE}:${REMOTE_TAG}" ``` ### Technical Analysis The script embeds `GITHUB_TOKEN` directly into an HTTPS Git remote URL. This causes the credential to cross two additional exposure boundaries: 1. The complete URL may be visible in local process inspection while `git clone` is running. 2. Git commonly records the authenticated origin URL in the cloned repository's `.git/config`, leaving a plaintext token in the temporary directory. Although the script ...[truncated 1866 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never embed access tokens in Git URLs. 2. Use `gh repo clone` with credentials managed by GitHub CLI, or use a temporary `GIT_ASKPASS` or credential-helper mechanism that does not persist the token in the remote URL. 3. After cloning, explicitly ensure that the origin URL contains no credentials. 4. Register cleanup immediately after creating the temporary directory: ```bash TEMP_DIR=$(mktemp -d) || exit 1 trap 'rm -rf -- "$TEMP_DIR"' EXIT INT TERM HUP ``` 5. Check the return status of every clone, copy, commit, and push operation before reporting success. 6. Use the configured `CNB_GITHUB_REPO` consistently and verify that it matches the authenticated user's intended repository. 7. Eliminate the requirement for a plaintext `GITHUB_TOKEN` when `gh auth login` is available. 8. Require a fine-grained, short-lived token limited to the synchronization repository if token-based automation remains necessary. 9. Rotate GitHub tokens used with affected versions, particularly if execution was interrupted or temporary directories may remain. ]]>

T08 · Insecure Dependencies

Warning

• Location: workflow/docker-image-sync.yml:17
• Finding: GitHub Actions Dependencies Use Mutable Version Tags<![CDATA[ ## Vulnerability Details **File Location**: `workflow/docker-image-sync.yml:17-24` **Vulnerability Type**: Unpinned CI/CD supply-chain dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml - name: 检出代码 uses: actions/checkout@v4 - name: 设置 Docker Buildx uses: docker/setup-buildx-action@v3 - name: 登录到 CNB Docker 制品库 uses: docker/login-action@v3 ``` ### Technical Analysis The workflow references GitHub Actions by mutable major-version tags rather than immutable commit hashes: - `actions/checkout@v4` - `docker/setup-buildx-action@v3` - `docker/login-action@v3` A major-version tag can be moved to a different commit after this Skill has been reviewed. Consequently, the code executed by future workflow runs is not cryptographically fixed to the version that was audited. These actions execute in a job that checks out repository content and authenticates to the CNB registry. In particular, the login action directly receives `secrets.CNB_TOKEN`. A compromise of an upstream action repository, maintainer account, release process, or mutable tag could therefore introduce unreviewed code into a credential-bearing CI environment. No evidence was found that the currently referenced actions are malicious. The finding concerns the workflow's inability to guarantee that future executions use the audited implementation. ### Attack Path 1. An upstream action repository, maintainer account, or release tag is compromised. 2. One of the mutable tags is redirected to an attacker-controlled or malicious commit. 3. A user invokes this Skill, causing `images.txt` to be pushed and the workflow to run. 4. GitHub Actions resolves the mutable tag to the changed implementation. 5. The malicious action executes in the workflow environment. 6. It abuses repository context or registry authentication available to that job. ### Impact Assessment A successful supply-chain compromise may expose or misuse the CNB registry crede ...[truncated 389 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every third-party action to a reviewed full-length commit SHA, for example: ```yaml uses: actions/checkout@<reviewed-full-commit-sha> ``` 2. Preserve the human-readable release in a comment beside each pinned SHA. 3. Use Dependabot or an equivalent update mechanism to propose and review action SHA updates. 4. Remove `docker/setup-buildx-action` if Buildx is not required by the workflow, reducing the dependency surface. 5. Add an explicit least-privilege workflow permission declaration, such as: ```yaml permissions: contents: read ``` 6. Restrict the CNB token to the single destination registry repository and only the push operations required by this workflow. 7. Review action provenance and release attestations before updating pinned commits. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (35)

Credential Access

High

• Category: Privilege Escalation

Content

```

- **已登录** → 自动创建私有仓库 `cnb-docker-sync`（**默认私有，不会暴露镜像名**）
- **未登录** → 运行 `gh auth login` 在终端登录，或提供 GitHub Personal Access Token 给 openclaw

> Token 获取路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token
>

• Confidence: 92% confidence
• Finding: The skill tells the user they may provide a GitHub Personal Access Token to OpenClaw. Having the agent receive a token with repository, secrets, and workflow permissions creates significant credential-handling risk and broadens the blast radius if the token is exposed.

Credential Access

High

• Category: Privilege Escalation

Content

- **已登录** → 自动创建私有仓库 `cnb-docker-sync`（**默认私有，不会暴露镜像名**）
- **未登录** → 运行 `gh auth login` 在终端登录，或提供 GitHub Personal Access Token 给 openclaw

> Token 获取路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token
>
> **推荐方式（不过用户手）：**
> 运行 `gh auth login`，走设备码流程登录，token 自动由 `gh` 管理，无需用户复制粘贴

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- **已登录** → 自动创建私有仓库 `cnb-docker-sync`（**默认私有，不会暴露镜像名**）
- **未登录** → 运行 `gh auth login` 在终端登录，或提供 GitHub Personal Access Token 给 openclaw

> Token 获取路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token
>
> **推荐方式（不过用户手）：**
> 运行 `gh auth login`，走设备码流程登录，token 自动由 `gh` 管理，无需用户复制粘贴

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

> 运行 `gh auth login`，走设备码流程登录，token 自动由 `gh` 管理，无需用户复制粘贴
>
> **如果必须提供 Token（细粒度最小权限）：**
> 创建 Fine-grained Personal Access Token，限制到**仅 `cnb-docker-sync` 仓库**，权限：
> - `Contents: read and write`（读写仓库，触发 workflow）
> - `Secrets: read and write`（设置 Repository Secrets）
> - `Workflows: read and write`（触发 Actions）

• Confidence: 90% confidence
• Finding: Although framed as minimal scope, the skill still instructs users to create a fine-grained token that can read/write contents, secrets, and workflows for a repository. Those permissions are powerful, and if the agent handles the token directly, compromise could enable repository tampering, secret manipulation, and workflow abuse.

Credential Access

High

• Category: Privilege Escalation

Content

#### 2.4 获取 CNB_TOKEN

在制品库页面，找到**访问令牌**或 **Access Token** 配置，创建一个访问令牌（用于拉取凭证）。

### 第三步：提供参数给 openclaw

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### 2.4 获取 CNB_TOKEN

在制品库页面，找到**访问令牌**或 **Access Token** 配置，创建一个访问令牌（用于拉取凭证）。

### 第三步：提供参数给 openclaw

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill explicitly asks the user to send a CNB access token directly to the agent in chat. Sending secrets through chat increases the chance of credential exposure via logs, transcripts, model retention, plugins, or downstream tooling, and the skill also plans to persist that secret for reuse.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill instructs the user to paste CNB_TOKEN into chat and states that OpenClaw will write it to ~/.openclaw/.env and reuse it later. This creates both exposure risk during transmission and persistence risk after storage, making compromise of the chat system or local environment materially more damaging.

Credential Access

High

• Category: Privilege Escalation

Content

```

- **Logged in** → Automatically creates private repo `cnb-docker-sync` (**private by default, image names not exposed**)
- **Not logged in** → Run `gh auth login` in terminal, or provide a GitHub Personal Access Token to openclaw

> Token path: GitHub → Settings → Developer settings → Personal access tokens → Generate new token
>

• Confidence: 92% confidence
• Finding: The English section repeats the instruction to provide a GitHub Personal Access Token to the agent. Because the token enables repository operations and secret management, direct submission to the agent meaningfully increases credential exposure risk.

Credential Access

High

• Category: Privilege Escalation

Content

> Run `gh auth login` — device flow, token managed by `gh`, no copy-paste needed
>
> **If you must provide a Token (fine-grained, minimal scope):**
> Create a Fine-grained Personal Access Token limited to the **`cnb-docker-sync` repo only**, permissions:
> - `Contents: read and write` (commit/push to trigger workflow)
> - `Secrets: read and write` (set Repository Secrets)
> - `Workflows: read and write` (trigger Actions)

• Confidence: 90% confidence
• Finding: The documentation again authorizes creation of a powerful fine-grained token for agent-driven automation. Even with limited repository scope, the permissions include workflows and secrets, so exposure could let an attacker alter CI behavior, tamper with images, or exfiltrate stored secrets.

Credential Access

High

• Category: Privilege Escalation

Content

#### 2.4 Get CNB_TOKEN

In the CNB registry page, find **访问令牌** (Access Token) configuration, create an access token for pull authentication.

### Step 3 — Provide Parameters to openclaw

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### 2.4 Get CNB_TOKEN

In the CNB registry page, find **访问令牌** (Access Token) configuration, create an access token for pull authentication.

### Step 3 — Provide Parameters to openclaw

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

| Parameter | Description | Example |
|-----------|-------------|---------|
| `CNB_TOKEN` | CNB access token | `8B76Bopie1d966fVDMgJnhFRepZ` |
| `CNB_REGISTRY` | CNB registry address (fixed value) | `docker.cnb.cool` |
| `CNB_REPO_SLUG` | CNB namespace (lowercase) | `lufei123/lufei-docker` |
| `CNB_GITHUB_REPO` | Private repo address (format: `your-github-username/cnb-docker-sync`) | `your-github-username/cnb-docker-sync` |

• Confidence: 98% confidence
• Finding: This section explicitly asks the user to reply with the CNB access token value, including an example token format. Soliciting secrets in normal chat is dangerous because it exposes credentials to transcript storage, logs, and any system that processes the conversation.

Credential Access

High

• Category: Privilege Escalation

Content

# Docker官网镜像拉取能力
#
# 安全特性：
#   ✅ .env 加载：无 shell source，使用 IFS 逐行解析，避免注入
#   ✅ workflow 内嵌：不在制品内的是用户自建私有仓库
#   ✅ 默认私有仓库：不在制品内的是用户自建私有仓库，镜像名不暴露
#

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Docker官网镜像拉取能力
#
# 安全特性：
#   ✅ .env 加载：无 shell source，使用 IFS 逐行解析，避免注入
#   ✅ workflow 内嵌：不在制品内的是用户自建私有仓库
#   ✅ 默认私有仓库：不在制品内的是用户自建私有仓库，镜像名不暴露
#

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ─── 加载环境变量（安全解析，无 shell source）────────────
# 解析 .env 文件，仅提取技能需要的变量，避免注入风险
load_env() {
    local env_file="$HOME/.openclaw/.env"
    if [[ ! -f "$env_file" ]]; then
        return 0  # 文件不存在，继续用默认值
    fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

echo ""
        echo "请选择以下方式之一解决："
        echo "  1. 运行 'gh auth login' 在终端登录（推荐）"
        echo "  2. 提供 GitHub Personal Access Token 给 openclaw，我会帮你配置 GITHUB_TOKEN"
        echo ""
        echo "获取 Token 路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token"
        echo "所需权限：repo (全部) + workflow"

• Confidence: 93% confidence
• Finding: The script explicitly tells the user to provide a GitHub Personal Access Token to the agent so it can configure GITHUB_TOKEN. In an agent-skill context, instructing users to hand over a broad-scope PAT materially increases credential theft and misuse risk, because the token can grant repository and workflow control far beyond the immediate task and may traverse or be stored in systems the user does not expect.

Credential Access

High

• Category: Privilege Escalation

Content

echo "  1. 运行 'gh auth login' 在终端登录（推荐）"
        echo "  2. 提供 GitHub Personal Access Token 给 openclaw，我会帮你配置 GITHUB_TOKEN"
        echo ""
        echo "获取 Token 路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token"
        echo "所需权限：repo (全部) + workflow"
        exit 1
    fi

• Confidence: 95% confidence
• Finding: This line reinforces the PAT collection flow and recommends generating access tokens with broad repo and workflow permissions. In this skill context, that is especially dangerous because the same script later uses the token for authenticated git clone/push and secret management, meaning compromise of the token can lead to repository takeover, workflow abuse, and exposure of synchronized image metadata or further secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**openclaw 收到后会帮你完成以下操作：**

1. 写入 `~/.openclaw/.env`（注意：请保持该文件可信，`chmod 600 ~/.openclaw/.env`）
2. 自动创建私有仓库 `你的用户名/cnb-docker-sync`（如不存在）
3. 将 **内嵌的 GitHub Actions workflow** 推送到你的私有仓库（workflow 代码来自技能制品，透明可查）
4. 将 `CNB_REGISTRY`、`CNB_REPO_SLUG_LOWERCASE`、`CNB_TOKEN` 设置到私有仓库的 Repository Secrets

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**openclaw 收到后会帮你完成以下操作：**

1. 写入 `~/.openclaw/.env`（注意：请保持该文件可信，`chmod 600 ~/.openclaw/.env`）
2. 自动创建私有仓库 `你的用户名/cnb-docker-sync`（如不存在）
3. 将 **内嵌的 GitHub Actions workflow** 推送到你的私有仓库（workflow 代码来自技能制品，透明可查）
4. 将 `CNB_REGISTRY`、`CNB_REPO_SLUG_LOWERCASE`、`CNB_TOKEN` 设置到私有仓库的 Repository Secrets

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**openclaw 收到后会帮你完成以下操作：**

1. 写入 `~/.openclaw/.env`（注意：请保持该文件可信，`chmod 600 ~/.openclaw/.env`）
2. 自动创建私有仓库 `你的用户名/cnb-docker-sync`（如不存在）
3. 将 **内嵌的 GitHub Actions workflow** 推送到你的私有仓库（workflow 代码来自技能制品，透明可查）
4. 将 `CNB_REGISTRY`、`CNB_REPO_SLUG_LOWERCASE`、`CNB_TOKEN` 设置到私有仓库的 Repository Secrets

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**openclaw 收到后会帮你完成以下操作：**

1. 写入 `~/.openclaw/.env`（注意：请保持该文件可信，`chmod 600 ~/.openclaw/.env`）
2. 自动创建私有仓库 `你的用户名/cnb-docker-sync`（如不存在）
3. 将 **内嵌的 GitHub Actions workflow** 推送到你的私有仓库（workflow 代码来自技能制品，透明可查）
4. 将 `CNB_REGISTRY`、`CNB_REPO_SLUG_LOWERCASE`、`CNB_TOKEN` 设置到私有仓库的 Repository Secrets

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

When `hub.docker.com` is unreachable, this skill proxies through GitHub Actions:

1. Modify `images.txt` in the GitHub repo — **clear all entries, write only the target image**
2. Push to trigger GitHub Actions sync to CNB
3. Wait for Actions completion
4. Pull the image from CNB to local

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.