rock-eval

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). 不安全：该 skill 要求在 shell 命令中以明文插入/传递凭据（例如 echo "export ROCK_TOKEN=" >> ~/.bashrc、注入 ANTHROPIC_API_KEY、通过 --api-key 透传），这会让模型必须生成或包含秘密值的逐字文本，存在泄露风险。

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Several URLs point to direct shell installers served over plain HTTP (http://xrl.alibaba-inc.com/install.sh and install_beta.sh), which is a high-risk pattern for malware distribution; the list also includes internal/.local endpoints (rock-marketplace.local, evamux.alibaba-inc.com) and one legitimate public schema (json-schema.org), but the unencrypted direct-download scripts and the malformed "https://" entry make the overall set suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). 该 skill 的运行态会通过 rc agent view --trajectory / rc agent fs cat .../exception.txt / rc agent fs cat .../result.json 等读取“任务/日志/trajectory”文本，并把这些内容拼入诊断子 agent 的 LLM 上下文（Phase 2/3 的 deep-analysis 子 agent 读取远端 trial 数据后进行根因分析）。这些 trial/日志/trajectory 的文本来源于非操作用户（bench/任务数据与执行产物由外部系统生成），属于 outsider-authored free text 注入面。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly runs remote install scripts at runtime using commands like rc sandbox <SANDBOX_ID> exec 'bash -c "$(curl -fsSL http://xrl.alibaba-inc.com/install.sh)"' (and the beta variant http://xrl.alibaba-inc.com/install_beta.sh), which fetches and executes remote code in the sandbox.