T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:188- Finding
Unvalidated configuration values are interpolated into shell commands and Python source
- Content
View full analysis
- Remediation
View remediation
Security audit
proxy-expert魔法搭建专家
Security checks for vulnerabilities and agentic risk
Overview
This skill is explicit about building a proxy VPS, but it automates sensitive SSH and server changes with weak safety controls.
Install only if you intentionally want an agent to administer a VPS for proxy deployment. Before using it, verify SSH host keys yourself, avoid storing passwords in project files, review every command before execution, pin and verify downloaded binaries, and plan how to remove the injected SSH key, generated secrets, and systemd service if you stop using it.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:188- Finding
SSH host identity verification is explicitly disabled during credential use and key installation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:67- Finding
SSH passwords, upstream credentials, and generated private keys are handled as unprotected plaintext
- Content
View full analysis
", "server_port": , "version": "5", "username": "", "password": "" } ``` ```bash ssh ... "curl -x socks5://USER:PASS@UPSTREAM_IP:PORT -o /dev/null -w '%{speed_download}' https://speed.cloudflare.com/__down?bytes=10000000" ``` ### Technical Analysis The Skill directs users to store the VPS password and upstream SOCKS password in an ordinary working-directory file. It also stores Reality private-key material in `.proxy-keys.txt`. The files are described as sensitive, but the workflow does not require a restrictive `umask`, explicit file permissions, encryption, cleanup, or source-control exclusions. Using `sshpass -p` places the SSH password in a process argument. Similarly, embedding SOCKS credentials in a curl proxy URL exposes them in the command line. Depending on the platform and execution environment, process arguments may be visible to other local users, process-monitoring tools, shell histories, logs, Agent transcripts, or diagnostic systems. The upstream password is also written into `/etc/sing-box/config.json`. Th ...[truncated 1237 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:195- Finding
Mutable, unpinned dependencies and executable releases are installed without integrity verification
- Content
View full analysis
/dev/null || true .venv/bin/pip install paramiko -q 2>/dev/null || .venv/Scripts/pip install paramiko -q ``` ```bash ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') SB_VER=$(curl -s https://api.github.com/repos/SagerNet/sing-box/releases/latest | grep tag_name | cut -d '"' -f4 | sed 's/v//') cd /tmp wget -q "https://github.com/SagerNet/sing-box/releases/download/v${SB_VER}/sing-box-${SB_VER}-linux-${ARCH}.tar.gz" tar -xzf "sing-box-${SB_VER}-linux-${ARCH}.tar.gz" cp "sing-box-${SB_VER}-linux-${ARCH}/sing-box" /usr/local/bin/ chmod +x /usr/local/bin/sing-box sing-box version ``` ### Technical Analysis The Skill installs the latest available Paramiko package without a version constraint or hash. It recommends an unofficial Homebrew tap for `sshpass`. It also discovers the current sing-box release dynamically, downloads its executable archive, and installs the binary into `/usr/local/bin` without checking a cryptographic checksum or signature. The sing-box URL is the official SagerNet GitHub release path rather than a personal paste or code-hosting location. Nevertheless, the effective executable can change after the Skill has been reviewed because the workflow follows the mutable `latest` release. TLS authenticates the download endpoint but does not protect against a compromised upstream account, malicious release, dependency takeover, or registry compromise. The downloaded sing-box executable is subsequently launched as a persistent service with elevated Linux capabilities. ### Attack Path 1. An upstream package, third-party tap, registry account, or release account is compromised. 2. A malicious package version or sing-box archive becomes the versi ...[truncated 828 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:319- Finding
Persistent sing-box service is granted broader network capabilities than the demonstrated configuration requires
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:617- Finding
Troubleshooting content can be persistently rewritten from incident-derived input
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (27)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are broad enough to activate on common user requests about connectivity or VPNs, causing the agent to enter a high-risk workflow that automates SSH access, deployment, credential handling, and local file creation. In this context, accidental invocation is especially dangerous because the skill is designed to manipulate sensitive infrastructure and secrets, not just provide informational guidance.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation text uses many broad trigger phrases such as VPN, proxy, blocked services, and product names, making accidental invocation likely during ordinary conversation. Because this skill performs credential handling, remote SSH actions, package installation, and config generation, overbroad activation materially increases the chance of high-risk actions being suggested or started in the wrong context.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill automates appending a locally generated SSH public key into the remote user's authorized_keys, creating persistent access to the VPS from the local machine. In context, this is intended for convenience, but it is still sensitive credential modification that can outlive the session and could be abused if the local key or workspace is later compromised.
- Content
md cmd = ( f"mkdir -p ~/.ssh && chmod 700 ~/.ssh && " f"echo '{pubkey}' >> ~/.ssh/authorized_keys && " f"chmod 600 ~/.ssh/authorized_keys && " f"echo 公钥注入成功" )
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 94% confidence
- Finding
The YARA match is justified by behavior that appends a new key into authorized_keys, a classic persistence mechanism also used by malware and unauthorized admins. In this skill’s context the action is framed as automation for setup, but because it silently establishes durable SSH access, it remains security-sensitive and dangerous if triggered in the wrong environment or by a compromised agent.
- Content
D}" pubkey_path = "~/.ssh/proxy_expert_ed25519.pub"
import os pubkey_path = os.path.expanduser(pubkey_path) with open(pubkey_path) as f: pubkey = f.read().strip()
client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.connect(host, port=port, username=user, password=password, timeout=15)
cmd = ( f"mkdir -p ~/.ssh && chmod 700 ~/.ssh && " f"echo '{pubkey}' >> ~/.ssh/authorized_keys && " f"chmod 600 ~/.ssh/authorized_keys && " f"echo 公钥注入成功" ) stdin, stdout, stderr = client.exec_command(cmd) print(stdout.read().decode()) err = stderr.read().decode() if err: print("STDERR:", err, file=sys.stderr) client.close() PYEOF
text 看到 "公钥注入成功" 则继续。 3. 验证密钥可用（无论用哪种方式注入，最后都验证一次）： ```bash ssh -i ~/.ssh/proxy_expert_ed25519 -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p {SSH_PORT} {SSH_USER}@{VPS_IP} "echo 密钥登录成功"看到 "密
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Changing permissions on authorized_keys is part of a workflow that modifies remote authentication state. In this context the danger is not the chmod itself but the fact that the skill is directly managing login persistence on the server, which expands long-term access and attack surface if done without strong approval and lifecycle controls.
- Content
md cmd = ( f"mkdir -p ~/.ssh && chmod 700 ~/.ssh && " f"echo '{pubkey}' >> ~/.ssh/authorized_keys && " f"chmod 600 ~/.ssh/authorized_keys && " f"echo 公钥注入成功" ) stdin, stdout, stderr = client.exec_command(cmd)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The command combines --resolve with -k to force TLS to a user-supplied IP while disabling certificate verification, effectively normalizing a trust-bypass pattern. Even though used here for protocol testing, teaching or automating insecure curl invocations can mask MITM or endpoint mismatch issues and may be reused in less controlled contexts.
- Content
测试 2：Reality 伪装
bash # Mac/Linux（关闭系统代理后执行） curl -sI --resolve "www.apple.com:443:{VPS_IP}" https://www.apple.com/ -k 2>&1 | head -5Windows 用
curl.exe（加.exe后缀）。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json }, { "id": 2, "prompt": "我已经填好 proxy-setup-info.txt 了，文件内容是：\n\nVPS_IP=192.168.1.100\nSSH_PORT=22\nSSH_USER=root\nSSH_AUTH=key\nSSH_PASSWORD=\nSSH_KEY_PATH=~/.ssh/id_ed25519\nUPSTREAM_IP=10.0.0.1\nUPSTREAM_PORT=1080\nUPSTREAM_USER=testuser\nUPSTREAM_PASS=testpass\nPLAN=C\nSNI_DOMAIN=www.apple.com\n\n请读取这个配置，给我展示一下即将部署的方案摘要，然后生成 clash-verge-config.yaml（假设密钥已经生成：UUID=fake-uuid-1234, PublicKey=fakePubKey5678, ShortID=abcd1234）", "expected_output": "1) 展示方案摘要：VPS 192.168.1.100:22、方案 C（混合路由）、SNI www.apple.com、上游 10.0.0.1:1080；2) 在当前目录生成 clash-verge-config.yaml，包含正确的 server/uuid/public-key/short-id 字段、VPS IP 直连规则、udp:false、client-fingerprint:chrome；3) 文件顶部有导入说明注释", "files": [] },
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
This command deliberately overrides DNS resolution with curl --resolve and disables TLS certificate validation with -k, causing the client to connect to an arbitrary IP while suppressing normal identity checks. In a proxy-circumvention skill, this normalizes unsafe TLS practices and could train users to accept man-in-the-middle conditions or trust spoofed endpoints during diagnosis.
- Content
Mac/Linux（关闭系统代理后执行）：
bash curl -sI --resolve "www.apple.com:443:{VPS_IP}" https://www.apple.com/ -k | head -5Windows：
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README describes creation of files containing VPS information, SSH credentials, and generated keys, but the warning is not prominent and action-oriented at the point where users are told to start the workflow. Users may proceed without understanding that sensitive secrets will be stored locally in plaintext-style working files, increasing the chance of accidental exposure through backups, sync tools, shared directories, or source control.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description and the rest of the skill are written to operate in Chinese and instruct specific Chinese phrasing, but there is no option for the user to choose another language. This can violate language or locale policy when the skill is invoked for users who did not opt into Chinese-only behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs creation of local files containing VPS IPs, SSH passwords, key paths, and proxy credentials, but does not prominently warn about local secret-at-rest risk. Those files may be left in project directories, synced to cloud storage, captured in backups, or accidentally committed, exposing infrastructure and upstream proxy accounts.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md client.connect(host, port=port, username=user, password=password, timeout=15) cmd = ( f"mkdir -p ~/.ssh && chmod 700 ~/.ssh && " f"echo '{pubkey}' >> ~/.ssh/authorized_keys && " f"chmod 600 ~/.ssh/authorized_keys && " f"echo 公钥注入成功"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md cmd = ( f"mkdir -p ~/.ssh && chmod 700 ~/.ssh && " f"echo '{pubkey}' >> ~/.ssh/authorized_keys && " f"chmod 600 ~/.ssh/authorized_keys && " f"echo 公钥注入成功" ) stdin, stdout, stderr = client.exec_command(cmd)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
ssh -i ~/.ssh/proxy_expert_ed25519 -o StrictHostKeyChecking=no -o ConnectTimeout=10 -p {SSH_PORT} {SSH_USER}@{VPS_IP} "echo 密钥登录成功"
text 看到 "密钥登录成功" 则继续。失败时常见原因：authorized_keys 权限不对（重新用密码登 chmod 600）、VPS 禁用了密码认证（检查 `/etc/ssh/sshd_config` 的 `PasswordAuthentication`）。 > **注意**：整个过程用户不需要打开 VPS 的 Web 终端或自己执行任何命令，全部由本地 AI 自动完成。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill performs extensive remote administrative changes—system updates, package installs, service creation, network tuning, and security tooling setup—without an explicit warning that these actions are persistent and may affect system stability, connectivity, or existing services. In a high-privilege SSH context, lack of a safety gate raises the risk of unintended destructive or availability-impacting changes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill retrieves release metadata and binaries from external services at runtime, which is expected for installation but still introduces a supply-chain and data-exposure surface. If upstream content is compromised, rate-limited, or replaced, the agent may install malicious or unverified software onto the target VPS.
- Content
4.2 安装 sing-box（自动获取最新版）
bash ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') SB_VER=$(curl -s https://api.github.com/repos/SagerNet/sing-box/releases/latest | grep tag_name | cut -d '"' -f4 | sed 's/v//') cd /tmp wget -q "https://github.com/SagerNet/sing-box/releases/download/v${SB_VER}/sing-box-${SB_VER}-linux-${ARCH}.tar.gz" tar -xzf "sing-box-${SB_VER}-linux-${ARCH}.tar.gz"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Enabling a systemd service creates persistence across reboots, which is expected for a proxy server but still a meaningful security-relevant state change. In the context of a skill that can run unattended SSH commands, persistent background services increase the impact of misconfiguration or malicious package substitution.
- Content
md mkdir -p /var/lib/sing-box systemctl daemon-reload systemctl enable sing-box systemctl start sing-box sleep 3 systemctl status sing-box --no-pager
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest presents the skill as a deployment/config/testing workflow, but these lines add persistent self-maintenance of the skill’s own assets. That mismatch increases risk because a user may authorize one-time system setup while the skill also changes installed skill content, creating unreviewed long-term behavior changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill tells the agent to modify its own installed reference documentation during troubleshooting, which breaks the boundary between using skill assets and mutating them. This creates a persistence/tampering path where operational data from one run can silently alter future behavior, potentially poisoning later sessions or broadening the skill beyond what was reviewed.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The eval prompts explicitly exercise setup of censorship-circumvention infrastructure using euphemistic language like '搭梯子' and '翻墙', but the technical outputs requested are concrete deployment steps for VLESS+Reality and client configs. In this skill context, that is not merely descriptive discussion: it operationalizes anti-censorship evasion and tests the agent’s ability to help users bypass network controls.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This troubleshooting eval is framed symptomatically, but it specifically teaches recognition of GFW active probing and temporary port blocking, along with diagnostic and corrective steps. That materially improves a user's ability to maintain censorship-evasion infrastructure against detection, making the skill more dangerous than a generic networking troubleshooter.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill document is written in Chinese, including headings, instructions, field explanations, and error guidance, with no indication that the language is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The configuration explicitly enables logging to /var/log/sing-box/sing-box.log but the documentation does not warn that connection metadata, errors, and possibly operational details may be written to persistent storage. In the context of a censorship-circumvention/proxy deployment skill, retained logs can materially increase user risk if the host is inspected, compromised, or seized, because they may reveal service usage patterns and infrastructure details.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire troubleshooting guide is written in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Mac：
bash sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder
Static analysis
No suspicious patterns detected.