Security audit

proxy-expert魔法搭建专家

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed proxy setup helper, but it should be reviewed carefully because it handles plaintext credentials, changes a VPS persistently, and can modify its own installed reference files.

Install only if you intentionally want an agent to configure a VPS-based proxy and you are comfortable giving it SSH access to that server. Use a dedicated non-production VPS, review commands before execution, verify the server fingerprint yourself, and keep proxy-setup-info.txt and .proxy-keys.txt out of synced folders, shared workspaces, backups, and repositories. Rotate credentials if those files are exposed, and watch for the skill modifying its own troubleshooting reference files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to modify its own reference documentation during troubleshooting, which creates a self-modifying behavior outside the user's immediate proxy setup task. This can permanently poison future runs with unreviewed content derived from prior incidents or attacker-controlled inputs, expanding impact beyond a single session.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger phrases are broad and include common user expressions such as asking for help with VPNs, proxies, or access problems, which can cause the skill to auto-activate outside narrowly intended contexts. In this skill, that matters more because activation leads into guidance for deploying censorship-circumvention infrastructure and handling sensitive credentials, so accidental invocation can produce risky or policy-sensitive assistance.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger phrases are overly broad and include common terms such as VPN, proxy, and inability to access popular services, which can cause this high-impact automation skill to activate in unrelated contexts. Because the skill performs credential handling, SSH access, and remote system modification, accidental invocation materially increases the chance of unsafe actions on the wrong task or host.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs creation of a local file containing highly sensitive data including VPS IP, SSH password, and private key path, but does not provide strong, upfront warnings about local credential exposure risks. Storing credentials in plaintext can lead to leakage through backups, shell history-adjacent workflows, other local users, or accidental sync/upload.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill directs the agent to save generated key material, including the server private key, into a local hidden file without sufficient security controls or user warning. Hidden files are not secure by default, and compromise of this file could enable unauthorized server impersonation or full loss of confidentiality for the proxy deployment.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill performs extensive remote system changes including package upgrades, service installation, firewall-adjacent tooling, kernel/network tuning, and persistent service enablement, but lacks a clear consolidated warning that these are destructive or availability-affecting changes. Users may authorize execution without understanding the impact on an existing production host.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill repeatedly instructs the agent to read and reuse a local file containing sensitive credentials before each SSH operation. Repeated broad access to a plaintext secret store increases exposure surface and the chance that secrets are mishandled, echoed, logged, or used in the wrong context.

Ssd 3

Medium

Confidence: 83% confidence
Finding: The troubleshooting flow instructs reading full setup and acceptance files, one of which may contain secrets and operational details, even when only partial information may be needed. This broad file access can unnecessarily expose credentials and infrastructure metadata during support flows.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The evals are structured as a step-by-step workflow to deploy, configure, and troubleshoot a censorship-circumvention proxy for accessing blocked services. In context, this materially operationalizes evasion of network restrictions and improves reliability against detection, making the skill more dangerous than a generic networking tutorial.

Static analysis

No suspicious patterns detected.