Security audit
Security checks across malware telemetry and agentic risk
This is a cloud memory and recovery tool, but it can send sensitive agent memory and identity files to a hard-coded service and persist automatic backup behavior without enough user control.
Install only if you intentionally want this agent's memories, selected identity/control files, host-derived registration data, and recovery tokens handled by the ai.syln.cn service. Treat the recovery URL like a password, review SOUL.md and HEARTBEAT.md changes before enabling setup, and avoid using it for secrets or regulated data unless you accept the plaintext fallback and remote-service trust model.
# 读取文件并 JSON 转义
CONTENT=$(jq -Rs '.' "$FP" 2>/dev/null || python3 -c "import sys,json; print(json.dumps(open('$FP').read()))")
RESP=$(curl -sS --ssl-reqd -X POST "$API" \
-H "Content-Type: application/json" \
-H "X-Kunlun-Key: $KEY" \
-d "{\"title\":\"$f\",\"content\":${CONTENT},\"file\":\"$f\"}" 2>/dev/null || echo '{"success":false}')echo "昆仑令: ${CODE:0:40}..."
echo "工作区: ${WORKSPACE}"
HTTP_CODE=$(curl -sS -o "$TMPFILE" -w "%{http_code}" -X POST "$API" \
-H "Content-Type: application/json" -d "{\"token\":\"$CODE\"}" 2>/dev/null || echo "000")
if [ "$HTTP_CODE" != "200" ]; then${token:+-H "Authorization: Bearer $token"} \
--data-urlencode "$data" 2>/dev/null || echo "000")
else
http_code=$(curl -sS --ssl-reqd -o "$tmp_out" -w "%{http_code}" -X POST "$url" \
-H "Content-Type: application/json" \
${token:+-H "Authorization: Bearer $token"} \
-d "$data" 2>/dev/null || echo "000")if [ -n "$preset_username" ]; then
echo -e "${YELLOW}发现预设昆仑身份: ${preset_username}${NC}"
local recover_res; recover_res=$(curl -sS --ssl-reqd -X POST "${api}/../api.php?route=auth/recover" \
-H "Content-Type: application/json" \
-d "{\"username\":\"${preset_username}\"}" 2>/dev/null || echo '{"success":false}')VirusTotal findings are pending for this skill version.
No suspicious patterns detected.