Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, read-only public debt-notice lookup skill with a clearly scoped optional guest-token bootstrap path.
Before installing, confirm you are comfortable with the optional guest fallback writing a short-lived read-only token and random device id under ~/.cache/debtop and sending limited attribution metadata to agent.debtop.com. Prefer an existing MCP/OAuth connector when available; if using guest mode, grant approval only when you intend to create or rebuild the guest credential.
声明描述的是一个面向公开债权公告的抵押物反查检索技能，核心能力应包括查询公告数据源、按抵押物线索搜索、解析公告文本并返回债权相关主体信息。但提供的代码完全没有网络请求、公告数据访问、文本检索、公告解析或任何与抵押物/债权相关的数据处理。相反，它专注于将客户端名称映射为标准化 client_id：读取本地 references/client-source-ids.md、做字符串归一化、slug 生成、命令行输出和自检。这不仅缺少声明中的关键功能，而且其主要目的与声明完全不同，因此属于明显的描述与行为不一致。
声明描述的是一个面向公开债权公告的只读抵押物反查能力，但提供的代码仅负责认证前置流程：校验白名单 URL、管理缓存文件、刷新或创建游客令牌、获取 challenge、求解 PoW、落盘 token 和 device id。代码没有出现任何针对公告数据源的查询、筛选、解析或返回抵押物/债权信息的逻辑。虽然令牌脚本可能是其他功能的辅助组件，但就这段代码本身而言，其实际行为与声明的核心用途明显不一致，因此应判定为 mismatch。
声明描述的是一个面向公开债权公告的抵押物反查/解析能力，核心行为应包括检索公告、定位债务人/出让方/保证人、提取抵押物名称与坐落面积等。而给出的代码完全没有任何与公告数据源、网络检索、文本解析、抵押物、债权公告相关的逻辑。其唯一用途是求解游客通道的 PoW 挑战，输出可用 nonce，并通过难度、时间和迭代限制避免 CPU 被滥用。这属于与声明主用途完全不同的能力，构成明显不匹配。
Referenced artifact was not completely inspected
上报给 `agent.debtop.com`（用于配额去重与归属统计）、并占用共享创建配额（单 IP 3 次/小时）；**得到用户许可后再执行** `bash scripts/guest_token.sh`。用户不同意时如实告知可改用「先在平台配置该 MCP 连接器 / 完成 OAuth 授权」。缓存里已有游客令牌时走
Referenced artifact was not completely inspected
上报给 `agent.debtop.com`（用于配额去重与归属统计）、并占用共享创建配额（单 IP 3 次/小时）；**得到用户许可后再执行** `bash scripts/guest_token.sh`。用户不同意时如实告知可改用「先在平台配置该 MCP 连接器 / 完成 OAuth 授权」。缓存里已有游客令牌时走
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- **读取的宿主平台变量**：`DEBTOP_CLIENT_NAME`（若存在，仅用于推断客户端标识 `skillId`）；`DEBTOP_CACHE_DIR` / `DEBTOP_POW_MAX_DIFFICULTY` / `DEBTOP_POW_MAX_SECONDS`（可选，用于调整缓存位置与求解护栏）。
- **上报内容**：创建游客时报 `skillId`（客户端标识）、`skillCode`（本技能包名）、`deviceFingerprint`（上面的匿名标识），目的地为本服务 `agent.debtop.com`，**仅用于来源归属统计与配额防滥用**；不向任何第三方转发。
- **清理方式**：`rm -rf "$HOME/.cache/debtop"`（或用 `DEBTOP_CACHE_DIR` 指定的目录）。删除后本机不再保留任何游客凭据，下次使用会重新申请游客令牌。
## 操作速查（可直接复制执行）
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- **读取的宿主平台变量**：`DEBTOP_CLIENT_NAME`（若存在，仅用于推断客户端标识 `skillId`）；`DEBTOP_CACHE_DIR` / `DEBTOP_POW_MAX_DIFFICULTY` / `DEBTOP_POW_MAX_SECONDS`（可选，用于调整缓存位置与求解护栏）。
- **上报内容**：创建游客时报 `skillId`（客户端标识）、`skillCode`（本技能包名）、`deviceFingerprint`（上面的匿名标识），目的地为本服务 `agent.debtop.com`，**仅用于来源归属统计与配额防滥用**；不向任何第三方转发。
- **清理方式**：`rm -rf "$HOME/.cache/debtop"`（或用 `DEBTOP_CACHE_DIR` 指定的目录）。删除后本机不再保留任何游客凭据，下次使用会重新申请游客令牌。
## 操作速查（可直接复制执行）
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# ⑤ MCP 三步握手（Authorization 由 -K 配置文件注入，下文所有请求都复用同一份）
# ⑤a initialize —— 从响应头取 Mcp-Session-Id，后续请求都要带
curl -s -K "$AUTH_CONF" -D "$CACHE/h.txt" -o "$CACHE/init.txt" -X POST "$BASE/mcp/debt/stream" \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"debtop-skill","version":"1.0"}}}'
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"debtop-skill","version":"1.0"}}}'
SID=$(grep -i '^mcp-session-id:' "$CACHE/h.txt" | awk '{print $2}' | tr -d '\r')
# ⑤b notifications/initialized（200/202 即成功）
curl -s -K "$AUTH_CONF" -o /dev/null -w "initialized=%{http_code}\n" -X POST "$BASE/mcp/debt/stream" \
-H "Mcp-Session-Id: $SID" \
-H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","method":"notifications/initialized"}'
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
[ "$waited" -ge 60 ] && { echo "等待缓存锁超时：请改用 bash scripts/guest_token.sh" >&2; exit 1; }
sleep 0.5; waited=$((waited + 1))
done
trap 'rm -rf "$CACHE/guest.json.lock.d"' EXIT
fi
# refreshToken 同样不进命令行: 请求体写进 0600 的临时配置文件, 用 curl -K 读取
python3 - "$CACHE/guest.json" "$CACHE/refresh.conf" <<'PY'
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
os.write(fd, ("data = " + json.dumps(body) + "\n").encode())
os.close(fd)
PY
curl -sS --max-time 20 -X POST "$BASE/bff/v1/guest-access/refresh" -H 'Content-Type: application/json' \
-K "$CACHE/refresh.conf" -o "$CACHE/guest.new" -w 'http=%{http_code}\n' -S
rm -f "$CACHE/refresh.conf"
# 只有确实是成功体（含 data.accessToken）才覆盖缓存；错误响应一律不写进 guest.json
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
PY
curl -sS --max-time 20 -X POST "$BASE/bff/v1/guest-access/refresh" -H 'Content-Type: application/json' \
-K "$CACHE/refresh.conf" -o "$CACHE/guest.new" -w 'http=%{http_code}\n' -S
rm -f "$CACHE/refresh.conf"
# 只有确实是成功体（含 data.accessToken）才覆盖缓存；错误响应一律不写进 guest.json
if python3 -c 'import json,sys
d=(json.load(open(sys.argv[1])).get("data") or {})
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo "已刷新并原地覆盖 guest.json（旧 refreshToken 作废）"
else
echo "刷新失败，缓存未被覆盖（保留原令牌）" >&2
rm -f "$CACHE/guest.new"
fi
# 刷新后要重跑 ④ 重建 curl-auth.conf（accessToken 已更换）
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# ② 输出路径收敛: 输出文件解析后必须落在 CACHE_ROOT 之内, 且不得是符号链接;
# ③ 请求体用 JSON 序列化生成（不做字符串拼接）: 远端字段含引号也无法注入报文;
# ④ 令牌不打印到 stdout: 避免进入命令行（ps 可见）、工具输出与会话记录;
# 调用方从 0600 的输出文件读取, 用 curl -K 配置文件传 Authorization 头。
set -euo pipefail
# 凭据落盘的权限约束：guest.json 里是可直接调用后端的 access/refresh token 与设备标识,
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
RT="$(read_refresh "$OUT")"
if [ -n "$RT" ]; then
REFRESH_BODY="$(REFRESH_TOKEN="$RT" python3 -c 'import json, os; print(json.dumps({"refreshToken": os.environ["REFRESH_TOKEN"]}))')"
if curl -sS --max-time 20 -X POST \
-H 'Content-Type: application/json' \
-d "$REFRESH_BODY" -o "$TMP" \
"$BASE/bff/v1/guest-access/refresh" \
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
}, ensure_ascii=False))
PY
)"
curl -sS --max-time 20 -X POST "$BASE/bff/v1/guest-access" \
-H 'Content-Type: application/json' \
-d "$CREATE_BODY" -o "$TMP"
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
}, ensure_ascii=False))
PY
)"
curl -sS --max-time 20 -X POST "$BASE/bff/v1/guest-access" \
-H 'Content-Type: application/json' \
-d "$CREATE_BODY" -o "$TMP"
The skill instructs outbound network communication to a remote service and guest-access endpoints, including metadata and token/bootstrap flows. Even though the destination is constrained to agent.debtop.com and the purpose is disclosed, this still creates an external data transmission surface involving device fingerprinting, client identifiers, and user-supplied query context, which can expose metadata or be abused if the endpoint or transport assumptions fail.
curl -s $BASE/.well-known/oauth-protected-resource | grep -qE '"public_create"[[:space:]]*:[[:space:]]*true' \
&& echo "元数据 OK (公开通道已开启)" # 注意: 响应是紧凑 JSON, 冒号后可能无空格
# 2) PoW 挑战端点应可达
curl -s -o /dev/null -w "challenge=%{http_code}\n" $BASE/bff/v1/guest-access/challenge
# 期望: 200；若为 404 说明 GUEST_PUBLIC_CREATE_ENABLED=false
# 3) 免凭据创建必须被要求 PoW（准入校验生效）
curl -s -X POST $BASE/bff/v1/guest-access -H 'Content-Type: application/json' -d '{"source":"web"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ⑤ MCP 三步握手（Authorization 由 -K 配置文件注入，下文所有请求都复用同一份）
# ⑤a initialize —— 从响应头取 Mcp-Session-Id，后续请求都要带
curl -s -K "$AUTH_CONF" -D "$CACHE/h.txt" -o "$CACHE/init.txt" -X POST "$BASE/mcp/debt/stream" \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"debtop-skill","version":"1.0"}}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"debtop-skill","version":"1.0"}}}'
SID=$(grep -i '^mcp-session-id:' "$CACHE/h.txt" | awk '{print $2}' | tr -d '\r')
# ⑤b notifications/initialized（200/202 即成功）
curl -s -K "$AUTH_CONF" -o /dev/null -w "initialized=%{http_code}\n" -X POST "$BASE/mcp/debt/stream" \
-H "Mcp-Session-Id: $SID" \
-H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","method":"notifications/initialized"}'
The file’s user-facing natural-language content is entirely in Chinese, including the module docstring and operational guidance, which effectively imposes a single language on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified; neither is present here.
No suspicious patterns detected.