跳转到正文
skillsafebeta
← 报告库
用途分类 / 开发辅助

Replicas Agent Skill 安全审计

作者说它能做什么（原文）

Guide for background coding agents running inside Replicas cloud workspaces

第三方安全检查结论

先别安装或运行

已检查文件
10
发现的风险
6
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 2 项风险
高风险

CI 使用未锁定版本的 npx 包并执行全局安装

原文依据：3 处
发现了什么

验证工作流在 push 和 pull_request 上执行 npx skills，但命令没有锁定 npm 包的版本或完整性，并使用 --global -y 非交互安装。npx 在本地无匹配包时可从注册表解析并执行包代码。

为什么需要注意

如果 skills 包的当前发布版本、解析结果或依赖链被攻陷，第三方代码可在 GitHub Actions 运行器中执行，并访问该作业可见的检出内容、环境和 GitHub 令牌权限。

该工作流在 main 的 push 和 pull_request 上执行 `npx skills add`，未指定 npm 包版本或完整性，并带 `--global -y`。在运行器需要从注册表解析包时，安装脚本或包入口可在 CI 权限范围内执行；受影响权限取决于 GitHub 默认权限、事件类型和可用 secrets。用户可要求锁定精确版本/摘要、禁用生命周期脚本并最小化工作流权限。

.github/workflows/validate-skill.yml:3来自说明文档打开原文件
on:  push:    branches: [main]  pull_request:    branches: [main]
查看另外 2 个位置
.github/workflows/validate-skill.yml:15来自说明文档打开原文件
      - uses: actions/setup-node@v4        with:          node-version: "20"      - name: Install skill        run: npx skills add . --all --global -y
.github/workflows/validate-skill.yml:19来自说明文档打开原文件
      - name: Install skill        run: npx skills add . --all --global -y
中风险

预览重启流程可能终止不属于当前任务的服务

原文依据：3 处
发现了什么

指南要求服务作为脱离终端的后台进程持续运行，并指示在同一端口已有进程时先停止它，但没有要求确认进程归属或征得许可。

为什么需要注意

如果端口被另一个任务、用户或关键服务占用，代理可能中断该服务，导致预览、开发环境或其他工作负载不可用；新后台进程还会持续到工作区关闭。

这段证据能说明什么

指南确实要求在重启前停止同端口的“prior detached process”，但没有给出终止命令、匹配方法或授权边界。“prior”也可能仅指本任务先前启动的实例，因此现有证据不足以证明会终止无关服务。不过若实现只按端口杀进程，仍可能影响其他任务；用户可要求只停止由当前任务启动且身份已核实的 PID。

这项判断针对展示的代码和适用条件，不表示风险已经实际发生。
references/PREVIEWS.md:5来自说明文档打开原文件
## Running Services for PreviewServices must run as detached background processes so they survive after your command session ends. Do not leave them attached to a foreground terminal.
查看另外 2 个位置
references/PREVIEWS.md:18来自说明文档打开原文件
After starting a service:1. Verify the process is running: `pgrep -af 'yarn dev'`2. Check logs for readiness: `tail -f /tmp/app.log`3. Confirm it's actually serving: `curl -s http://localhost:3000` (or appropriate health check)4. Only create the preview after the service is healthyIf a prior detached process exists on the same port, stop it before restarting.
references/PREVIEWS.md:7来自说明文档打开原文件
Services must run as detached background processes so they survive after your command session ends. Do not leave them attached to a foreground terminal.Some potential methods:```bash# Start a detached service with loggingsetsid -f bash -lc 'cd /path/to/app && exec yarn dev >> /tmp/app.log 2>&1'# For daemons like Dockernohup dockerd > /tmp/dockerd.log 2>&1 &```
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 2 项风险
高风险

可配置网关地址会接收工作区引擎密钥

原文依据：4 处
发现了什么

指南把 REPLICAS_ENGINE_SECRET 作为 Bearer 凭据发送到由 MONOLITH_URL 环境变量决定的地址，却没有要求验证主机名或使用固定的受信地址。

为什么需要注意

如果该环境变量被仓库启动脚本、环境配置或供应链组件错误设置或恶意修改，请求会把工作区引擎密钥发送给该地址；获得者可能借此调用该密钥允许的 Replicas 网关能力。

Google 集成示例把工作区引擎密钥作为 Bearer 凭据发送到 `$MONOLITH_URL` 指定的主机。若该环境变量被错误配置或被有权限者篡改，密钥会随请求发往该地址；可要求作者说明该变量是否由平台锁定、是否校验 HTTPS 和允许的主机。源码也说明代理拿不到 Google 令牌本身，因此直接风险是工作区引擎密钥及其网关权限。

references/GOOGLE.md:7来自说明文档打开原文件
The integration is configured at the org or user level by the Replicas admin. From inside a workspace you don't have a Google access token directly; instead you call the monolith's `/v1/gdrive/*` endpoints, authenticated with your workspace's engine secret. The monolith refreshes the org's (or user's) Google access token and proxies the call.
查看另外 3 个位置
references/GOOGLE.md:11来自说明文档打开原文件
```bashcurl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \  -H "X-Workspace-Id: $WORKSPACE_ID"```
references/GOOGLE.md:20来自说明文档打开原文件
Standard auth headers used by every call below:```Authorization: Bearer $REPLICAS_ENGINE_SECRETX-Workspace-Id: $WORKSPACE_ID```
references/GOOGLE.md:12来自说明文档打开原文件
```bashcurl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \  -H "X-Workspace-Id: $WORKSPACE_ID"```
中风险

生成或外发的媒体会被复制到额外托管服务

原文依据：3 处
发现了什么

指南要求代理创建的媒体在分析前先上传至 Replicas；计划发往 Slack、Linear 或 GitHub 的内容还必须额外上传至 Replicas。GitHub 截图又被要求放到 Imgur 或其他外部主机。

为什么需要注意

屏幕截图和录屏可能包含源代码、客户资料、令牌、通知或其他屏幕信息。自动建立 Replicas、目标平台和图片主机的多份副本，会扩大访问面、保留范围和删除难度。

指南要求代理生成的媒体在分析前上传到 Replicas，并要求任何准备外发的媒体也复制到 Replicas；GitHub 图片还需上传到 Imgur 或其他外部主机。这会增加保存副本和可访问链接的服务数量，可能泄露截图中的代码、身份信息或凭据。规则不要求自动上传无关的用户文件，但用户仍可要求外发前逐项确认、先脱敏，并禁止第三方图床。

references/MEDIA.md:11来自说明文档打开原文件
Upload to Replicas in these cases — and **only** these cases:1. **Media you produce.** Any screenshot, screen recording, generated diagram, or audio clip you create that the user might want to see. Upload before doing anything else with the file (analyzing, deleting, sending elsewhere). This applies even when you're also sending the file to Slack, Linear, GitHub, etc.2. **Files the user explicitly asks you to upload.** If the user sends or points at a file (image, video, audio) and asks you to upload it, run `replicas media upload`. Otherwise leave it alone — files in the workspace the user did not ask about should not be auto-uploaded as media.3. **Anything you plan to share externally (Slack, Linear, GitHub, etc.).** Upload to Replicas *in addition to* the platform's native upload. Never as a replacement.If none of these apply, don't upload.
查看另外 2 个位置
references/MEDIA.md:63来自说明文档打开原文件
### On external platforms (Slack, Linear, GitHub, etc.)Do **both** of these — neither alone is sufficient:1. Upload the raw bytes via that platform's own upload API (Slack `files.upload`, Linear attachments, Imgur for GitHub PR/issue images, etc.) so the recipient actually sees the media.2. Include a `[View in Replicas](<deep-link>)` hyperlink — use the per-file deep link the CLI printed for that file (`...?mode=media&media=<media-id>`), so the recipient lands directly on that specific item.
references/GITHUB.md:117来自说明文档打开原文件
GitHub does NOT have a public API for uploading images to PRs/issues. When you need to include images:- Do NOT use placeholder image URLs- Do NOT commit screenshots as files to the repository- Upload images to Imgur (or another external host) and use the returned URLs in your PR markdown- If you were triggered from Slack, also upload the images to the Slack thread so the user can see them directly
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。发现 2 项风险
高风险

后端、API 甚至数据库预览可能在无认证状态下公开

原文依据：4 处
发现了什么

Skill 支持把本地服务公开为预览 URL，并明确建议后端/API 不使用认证。公开对象的示例范围还包括数据库。

为什么需要注意

若服务没有自身的强认证，互联网访问者可能读取数据、调用管理接口或触发有副作用的操作。浏览器跨域需求并不能保护公开端点。

该 Skill 可把 Web 应用、API 和数据库端口变成公开 URL，并以跨源调用为由明确建议后端/API 不启用认证。若服务含敏感数据、管理接口或本来只信任 localhost，创建预览后外部人员可能直接访问。风险只在代理实际创建预览时发生；用户可要求默认使用认证、限定可预览端口，并在公开前检查服务自身鉴权。

SKILL.md:14来自说明文档打开原文件
### PreviewsExpose locally running services (web apps, APIs, databases) as public preview URLs so humans can interact with them directly.
查看另外 3 个位置
references/PREVIEWS.md:28来自说明文档打开原文件
```bash# Expose a local port as a public URLreplicas preview create <port># Expose a port with authentication (requires Replicas login to access)replicas preview create <port> --authenticated
references/PREVIEWS.md:48来自说明文档打开原文件
**When NOT to use `--authenticated`:**- Backend APIs and other services that are called by frontend code. The frontend runs in the user's browser under a different origin, so it cannot forward the Replicas auth cookie to the backend. Making backends authenticated will cause cross-service requests to fail with 401 errors.**Rule of thumb:** Make frontend previews authenticated, leave backend/API previews unauthenticated.
SKILL.md:15来自说明文档打开原文件
### PreviewsExpose locally running services (web apps, APIs, databases) as public preview URLs so humans can interact with them directly.
中风险

预认证的外部账户能力包含高影响变更，指南未设置额外确认门槛

原文依据：6 处
发现了什么

Skill 直接提供合并和批准 GitHub 拉取请求、改变 Linear 工单状态以及执行任意 Slack Web API 操作的方法。虽然总览把它们放在相关任务场景中，但参考指南没有为这些高影响操作要求目标复核或临时确认。

为什么需要注意

任务描述歧义、错误解析的链接或外部内容中的误导指令，可能使代理在错误的仓库、工单或频道中执行真实账户变更。

参考指南展示了使用预认证凭据合并或批准 PR、改变 Linear 工单状态，并允许执行 Slack Web API 的其他操作。这些是活跃操作说明，而不只是安全警告；总览虽将其限定在相关任务中，却未规定合并、批准、改状态或广泛 Slack 操作前复核目标和取得临时确认。误解任务时可能改变代码、工作流或对外通信。用户可限制令牌权限，并要求写操作前明确确认账户、仓库、编号、频道和具体变更。

references/GITHUB.md:34来自说明文档打开原文件
# Merge a PRgh pr merge 123```
查看另外 5 个位置
references/GITHUB.md:110来自说明文档打开原文件
# Submit a reviewgh pr review 123 --approvegh pr review 123 --request-changes --body "Changes needed"```
references/LINEAR.md:33来自说明文档打开原文件
### Updating Issue State```bashcurl -s -X POST https://api.linear.app/graphql \  -H "Authorization: Bearer $LINEAR_ACCESS_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "query": "mutation { issueUpdate(id: \"ISSUE_UUID\", input: { stateId: \"STATE_UUID\" }) { success issue { identifier state { name } } } }"  }'```
references/SLACK.md:64来自说明文档打开原文件
### Other OperationsYou can list channels, read channel history, add reactions, and perform any other operation supported by the Slack Web API using the same authentication pattern.
references/GITHUB.md:31来自说明文档打开原文件
# Review/check PR statusgh pr checks 123# Merge a PRgh pr merge 123```
references/GITHUB.md:107来自说明文档打开原文件
# View PR review commentsgh api repos/owner/repo/pulls/123/reviews# Submit a reviewgh pr review 123 --approvegh pr review 123 --request-changes --body "Changes needed"```
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

1 个说明模块

此 Skill 是 Replicas 云工作区的操作指南，会根据任务引导代理使用预认证的 CLI、环境令牌和网关，操作预览、Slack、Linear、GitHub、Google Workspace、Docker、媒体及 Replicas 配置。

查看原文
SKILL.md:8来自说明文档打开原文件
You are a background coding agent running inside a Replicas cloud workspace (a remote VM). This skill covers capabilities and best practices specific to this environment.## CapabilitiesThis skill provides detailed guides for the following capabilities. **Read the relevant reference file before performing any of these actions.**
SKILL.md:86来自说明文档打开原文件
### Replicas (in-workspace CLI)Take action *with* Replicas itself — manage automations, environments (variables, files), repos, and `replicas.json` config — using the pre-installed, pre-authenticated `replicas` CLI.**Reference:** `references/REPLICAS.md`

Slack、Linear 和 GitHub 集成可读取数据，也可产生外部变更，例如发消息、评论、改变工单状态、批准或合并拉取请求；实际权限取决于预配置令牌。

查看原文
references/SLACK.md:32来自说明文档打开原文件
### Sending a Message```bashcurl -s -X POST "https://slack.com/api/chat.postMessage" \  -H "Authorization: Bearer $SLACK_BOT_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "channel": "CHANNEL_ID",    "text": "Your message here",    "thread_ts": "OPTIONAL_THREAD_TS"  }'```Omit `thread_ts` to post a new message to the channel. Include it to reply in a thread.
references/LINEAR.md:33来自说明文档打开原文件
### Updating Issue State```bashcurl -s -X POST https://api.linear.app/graphql \  -H "Authorization: Bearer $LINEAR_ACCESS_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "query": "mutation { issueUpdate(id: \"ISSUE_UUID\", input: { stateId: \"STATE_UUID\" }) { success issue { identifier state { name } } } }"  }'```
references/GITHUB.md:31来自说明文档打开原文件
# Review/check PR statusgh pr checks 123# Merge a PRgh pr merge 123```
references/GITHUB.md:110来自说明文档打开原文件
# Submit a reviewgh pr review 123 --approvegh pr review 123 --request-changes --body "Changes needed"```

Google 集成经 Replicas 网关代理，声明使用 drive.file 范围，只能访问由该集成创建或获准访问的文件；指南同时提供分享、编辑和删除这些文件的方法。

查看原文
references/GOOGLE.md:33来自说明文档打开原文件
## Important constraint: drive.file scopeThe integration uses the **sensitive-tier `drive.file` scope**. That means Replicas can only read and edit Google files **it created itself**. It **cannot**:- Read or edit a user's pre-existing Google Docs, Sheets, or Forms — even ones that were shared with the connected Google account.- List or search the user's broader Drive.- Touch any file that was not created via these gateway endpoints.If the user asks you to edit an existing doc that Replicas didn't create, tell them this constraint and offer to create a new doc that mirrors what they want.
references/GOOGLE.md:188来自说明文档打开原文件
## Drive operations (only on Replicas-created files)### Share a file with a person```bashcurl -s -X POST "$MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "${GDRIVE_AUTH[@]}" \  -H "Content-Type: application/json" \  -d '{    "type": "user",    "role": "writer",    "emailAddress": "alice@example.com",    "sendNotificationEmail": true  }'```Roles: `reader`, `commenter`, `writer`. Types: `user`, `group`, `domain`, `anyone`.
references/GOOGLE.md:238来自说明文档打开原文件
### Delete a file```bashcurl -s -X DELETE "$MONOLITH_URL/v1/gdrive/files/$FILE_ID" "${GDRIVE_AUTH[@]}"```

仓库的 GitHub Actions 工作流会在推送和拉取请求时运行，并用 npx 全局安装此 Skill。

查看原文
.github/workflows/validate-skill.yml:3来自说明文档打开原文件
on:  push:    branches: [main]  pull_request:    branches: [main]
.github/workflows/validate-skill.yml:19来自说明文档打开原文件
      - name: Install skill        run: npx skills add . --all --global -y
从这里开始 · 工作说明SKILL.md
replicas-agent
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。

文件引用关系图

8 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录10 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/DOCKER.md已纳入全文
  • references/GITHUB.md已纳入全文
  • references/GOOGLE.md已纳入全文
  • references/LINEAR.md已纳入全文
  • references/MEDIA.md已纳入全文
  • references/PREVIEWS.md已纳入全文
  • references/REPLICAS.md已纳入全文
  • references/SLACK.md已纳入全文
  • .github/workflows/validate-skill.yml已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • .github/workflows/validate-skill.yml配套文件
  • SKILL.md工作说明
  • references/DOCKER.md配套文件
  • references/GITHUB.md配套文件
  • references/GOOGLE.md配套文件
  • references/LINEAR.md配套文件
  • references/MEDIA.md配套文件
  • references/PREVIEWS.md配套文件
  • references/REPLICAS.md配套文件
  • references/SLACK.md配套文件

代码和说明中提到的操作

安装其他软件包
.github/workflows/validate-skill.yml:20来自说明文档打开原文件
      - name: Install skill        run: npx skills add . --all --global -y
连接外部网站
SKILL.md:97来自说明文档打开原文件
For *questions about how Replicas works* (concepts, pricing, what a feature does), check https://docs.replicas.dev first and only fall back to this skill when the user is asking you to take an action.
references/GOOGLE.md:12来自说明文档打开原文件
```bashcurl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \
references/GOOGLE.md:18来自说明文档打开原文件
- If `hasCredentials` is `true`: you're good to go.- If `hasCredentials` is `false`: Google has not been connected for this org. Ask the user to go to **Settings → Integrations → Google** in the [Replicas dashboard](https://replicas.dev) and connect a Google account. Do not attempt Google operations until it's connected.
运行命令
references/DOCKER.md:7来自说明文档打开原文件
```bashsudo service docker start
references/DOCKER.md:13来自说明文档打开原文件
```bashdocker info
references/DOCKER.md:21来自说明文档打开原文件
- **Check before starting.** If you are unsure whether the daemon is already running, check first to avoid an unnecessary restart:  ```bash  docker info > /dev/null 2>&1 || sudo service docker start
读取密钥或账号配置
references/GOOGLE.md:12来自说明文档打开原文件
```bashcurl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \
references/GOOGLE.md:17来自说明文档打开原文件
- If `hasCredentials` is `true`: you're good to go.- If `hasCredentials` is `false`: Google has not been connected for this org. Ask the user to go to **Settings → Integrations → Google** in the [Replicas dashboard](https://replicas.dev) and connect a Google account. Do not attempt Google o …
references/GOOGLE.md:18来自说明文档打开原文件
- If `hasCredentials` is `true`: you're good to go.- If `hasCredentials` is `false`: Google has not been connected for this org. Ask the user to go to **Settings → Integrations → Google** in the [Replicas dashboard](https://replicas.dev) and connect a Google account. Do not attempt Google operations until it's connected.
读取了多少行
1,041
文件校验值（用于核对版本）
5db54e57aa696b694f450d9eaa5e1a9883de139f25fe10b49b86de9bed47c029