一、目标

Remote code download and execution detected

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash

The skill is granted the `Bash` tool, allowing it to execute arbitrary shell commands on the host system. This capability can be exploited for full system compromise, data exfiltration, or persistence.

allowed-tools: Bash, Read, Write, Edit, Grep, Glob

The skill is granted `Read`, `Write`, and `Edit` tools, allowing it to access, modify, and create files on the host system. This poses a significant risk for data exfiltration, integrity compromise, or injecting malicious scripts.

allowed-tools: Bash, Read, Write, Edit, Grep, Glob

The skill installs `aipexbase-cli` globally via `npm`. A compromised npm package or its dependencies could lead to arbitrary code execution and system compromise.

npm i aipexbase-cli -g

The skill handles and stores sensitive `manageToken` and `apiKey` in configuration files, which are then accessible to sub-agents. This increases the risk of credential theft or misuse if the agent or its sub-agents are compromised.

metadata: {"openclaw": {"requires": {"env": ["BAAS_MANAGE_TOKEN", "BAAS_BASE_URL"]}, "primaryEnv": "BAAS_MANAGE_TOKEN"}}, 询问用户提供 `manageToken`（管理员令牌）, cp <当前skill目录>/config.json ./baas-config.json, 使用 Edit 工具添加返回的 `apiKey` 和 `appId`。

The skill's design includes interaction with "自定义 API" (custom API), which could be leveraged to make arbitrary network requests to attacker-controlled endpoints for data exfiltration or to trigger malicious actions.

了解平台已提供的 AI（对话、图生文、文生图、文生语音/视频/音频）、自定义 API、物流查询、地理位置、通知（飞书/企微/邮件）等能力

The skill instructs the agent to spawn subagents using a detailed prompt template it constructs itself. The subagent prompt includes instructions to read arbitrary files, execute code operations, and make API calls. The parent agent controls the full prompt content passed to subagents, creating a vector for prompt injection propagation across agent boundaries.

必须启用subagent进行每个页面的独立开发，使用下方的 **Subagent 任务模板** 启动每个页面的开发任务。subagent工作完成后，无需告诉用户（不用给用户发送消息）。

The skill instructs the agent to collect sensitive credentials (manageToken, baseUrl, apiKey) from the user and write them to files on disk (config.json, baas-config.json). These credentials are then copied across multiple project directories. The skill also stores these in project directories under /tmp, which may be world-readable.

询问用户提供 `manageToken`（管理员令牌）... 读取 `<skill目录>/config.json`，检查 `baseUrl` 和 `manageToken` 是否已配置... cp <当前skill目录>/config.json ./baas-config.json

The skill instructs projects to be placed under /tmp with a timestamp, and credentials (apiKey, manageToken, baseUrl) are stored in baas-config.json files in those directories. /tmp is typically world-readable, exposing API keys to other processes on the system.

cd <项目目录，建议放到 /tmp/时间戳/项目名称 目录下>

The skill instructs the agent to execute multiple bash commands including installing software globally (npm i aipexbase-cli -g), modifying shell environment (source ~/.bashrc), and running apt-get with sudo. This constitutes a significant attack surface for supply chain attacks via the aipexbase-cli package.

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
npm i aipexbase-cli -g
sudo apt-get install -y zip

The skill instructs the agent to run sudo apt-get install -y zip, escalating to root privileges to install system packages. This is unnecessary for the stated functionality and represents a privilege escalation risk.

sudo apt-get install -y zip

The skill mandates spawning sub-agents for development tasks and instructs them to read `baas-config.json`, which contains sensitive API keys. This multi-agent setup increases the attack surface for credential exfiltration or malicious sub-agent actions.

必须启用subagent进行每个页面的独立开发, 读取以下文件的完整内容: ... {project_dir}/baas-config.json

Deployment instructions are not embedded in the skill but loaded dynamically from a references/deploy.md file at runtime. If that file is tampered with or replaced, it could inject arbitrary instructions into the agent's execution flow after user confirmation has already been obtained.

部署方法再去读取当前skill下的 `references/deploy.md` 获取