Hatsune Miku Monitor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 1.0.1

Overview

This skill is mostly a desktop monitor, but its one-click boost and setup instructions can make disruptive system changes without enough warning or control.

Review this carefully before installing. Avoid the passwordless sudoers instructions, do not enable autostart unless you specifically need it, and treat the boost button as a system cleanup tool that can close browser processes, alter swap/cache behavior, prune logs, and delete caches. A safer version would keep monitoring read-only or require explicit confirmation for each cleanup action.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:92

Finding

Passwordless privileged system operations violate least privilege

Content

View full analysis

/proc/sys/vm/drop_caches your_username ALL=(ALL) NOPASSWD: /usr/sbin/swapoff your_username ALL=(ALL) NOPASSWD: /usr/sbin/swapon your_username ALL=(ALL) NOPASSWD: /usr/bin/journalctl ``` ### Technical Analysis The documentation instructs users to grant passwordless sudo access to a general-purpose shell and several sensitive system-management commands. These permissions substantially exceed what is necessary for a desktop monitoring application. The shell entry is particularly dangerous because `/usr/bin/sh -c` is a general command interpreter. The `swapoff`, `swapon`, and `journalctl` entries also lack narrowly constrained arguments, potentially allowing uses beyond the intended cleanup workflow. Once configured, these commands can be invoked non-interactively through `sudo -n`, as implemented by the application. ### Attack Path 1. A user follows the enhanced-cleanup instructions and installs the proposed sudoers entries. 2. The application, another process running under the same user, or subsequently modified Skill code invokes the authorized commands through passwordless sudo. 3. The process modifies kernel cache state, disables swap, or removes system journal data without an authentication prompt. 4. If a permitted shell invocation can be made to match the configured rule, it may provide a broader root-level command-execution primitive. ### Impact Assessment Successful abuse can obtain privileged control over system memory management and system logs. Potential consequences include: - System-wide ...[truncated 361 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/hatsune-ball.py:352

Finding

The boost action silently terminates processes and performs destructive cleanup

Content

View full analysis

/proc/sys/vm/drop_caches'], check=False, stderr=subprocess.DEVNULL, timeout=1 ) except: pass # 5. Clear swap, if present try: subprocess.run(['sudo', '-n', 'swapoff', '-a'], check=False, stderr=subprocess.DEVNULL, timeout=2) subprocess.run(['sudo', '-n', 'swapon', '-a'], check=False, stderr=subprocess.DEVNULL, timeout=2) except: pass # 6. Clean journalctl logs try: subprocess.run(['sudo', '-n', 'journalctl', '--vacuum-time=1d'], check=False, stderr=subprocess.DEVNULL, timeout=3) except: pass # 7. Clean user cache directories import shutil cache_dirs = [ os.path.expanduser('~/.cache/thumbnails'), os.path.expanduser('~/.cache/pip'), os.path.expanduser('~/.cache/mesa_shader_cache'), ] for cache_dir in cache_dirs: if os.path.exists(cache_dir): try: shutil.rmtree(cache_dir, ignore_errors=True) os.makedirs(cache_dir, exist_ok=True) except: pass ``` ### Technical Analysis The “one-click boost” action performs operations with significantly broader effects than an ordinary in-process memory cleanup: - `pkill -f` terminates ...[truncated 1923 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: SKILL.md:117

Finding

Documentation enables persistent automatic execution through systemd

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/install-deps.sh:7

Finding

Unpinned dependencies are installed into the system Python environment

Content

View full analysis

/dev/null; then echo "Installing GTK dependencies..." sudo apt update sudo apt install -y python3-gi python3-gi-cairo gir1.2-gtk-3.0 elif command -v dnf &> /dev/null; then echo "Installing GTK dependencies..." sudo dnf install -y python3-gobject gtk3 elif command -v pacman &> /dev/null; then echo "Installing GTK dependencies..." sudo pacman -S --noconfirm python-gobject gtk3 else echo "Unknown package manager; install python3-gi and gtk3 manually" fi # Install Python dependencies echo "Installing Python packages..." pip3 install psutil pillow --break-system-packages 2>/dev/null || pip3 install psutil pillow ``` The same unsafe dependency policy is reflected in `package.json:9-15`: ```json "install-deps": "pip3 install psutil pillow --break-system-packages || pip3 install psutil pillow", "dependencies": { "python": ">=3.6", "gtk": ">=3.0", "psutil": "*", "pillow": "*" } ``` ### Technical Analysis The installer requests the latest available `psutil` and `pillow` releases without exact versions or integrity hashes. It also uses `--break-system-packages`, intentionally bypassing protections for operating-system-managed Python environments. The wildcard declarations do not create a reproducible dependency set. Future package releases can change behavior after the Skill has been reviewed. Installing into the system Python environment may overwrite or conflict with packages required by other applications. Redirecting pip errors to `/dev/null` further obscures installation failures. No evidence was found that the named packages are typosquatted or currently malicious; the risk arises from unpinned, non-reproducible, system-wide ...[truncated 952 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is a cute system monitor, but the documented behavior extends into aggressive system modification: cache dropping, swap cycling, log pruning, user cache deletion, and reported browser-process termination. This mismatch is dangerous because users may consent to a benign monitoring tool while unknowingly installing software that alters system state and can disrupt applications or remove useful data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill is presented as a desktop system monitor, but it also performs process termination, cache dropping, swap toggling, log deletion, and cache-directory deletion. This mismatch is dangerous because users grant trust based on a benign monitoring description while the code contains hidden system-modifying behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Destructive cleanup and privileged subprocess actions are exposed through the boost button without any explicit warning, preview, or confirmation. In the context of a cute desktop widget, this is especially dangerous because the interface lowers user suspicion while enabling significant changes to the host system.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The monitor includes unjustified privileged system-management capabilities via subprocess and sudo-based commands, far beyond what is necessary for displaying CPU, memory, disk, and temperature data. This increases attack surface and risk because a low-trust UI element can trigger broad host modifications.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The --noconfirm flag is a tool-parameter abuse pattern because it disables a safety checkpoint for a privileged package manager operation. In this skill context, the script is an installer for a desktop monitor tool, so bypassing confirmation is unnecessary and increases the risk of silent system changes.

Content

Scanner excerpt · scripts/install-deps.sh (reported line 16)May include surrounding context.

sh

sudo dnf install -y python3-gobject gtk3
elif command -v pacman &> /dev/null; then
    echo "📦 安装 GTK 依赖..."
    sudo pacman -S --noconfirm python-gobject gtk3
else
    echo "⚠️  未知的包管理器，请手动安装 python3-gi 和 gtk3"
fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L11 advertises "一键加速 — 清理内存和系统缓存" but does not disclose any risks, side effects, or what exactly will be cleaned. Because this behavior can affect system state and performance, the markdown description should warn users before presenting it as a simple one-click action.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

将初音 GIF 放到 /tmp/chuyin.gif 或创建 assets 目录：

bash

mkdir -p ~/.openclaw/workspace/skills/hatsune-miku-monitor/assets
cp your_hatsune.gif ~/.openclaw/workspace/skills/hatsune-miku-monitor/assets/chuyin.gif

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

安装依赖

bash

sudo apt install python3-gi python3-gi-cairo gir1.2-gtk-3.0
pip3 install psutil pillow

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

安装依赖

bash

sudo apt install python3-gi python3-gi-cairo gir1.2-gtk-3.0
pip3 install psutil pillow

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

安装依赖

bash

sudo apt install python3-gi python3-gi-cairo gir1.2-gtk-3.0
pip3 install psutil pillow

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

L50 tells users that the "⚡ 一键加速" action clears memory, but provides no caution about possible side effects, required permissions, or whether application/system caches will be altered. For markdown files, actions that may affect system integrity or data should include explicit warnings.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The README instructs users to enable a persistent user-level systemd service that will automatically relaunch the program on login. Persistence is security-relevant because it increases dwell time and makes removal harder if the skill later proves unsafe, especially since it runs code from a workspace path under the user's home directory.

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

WantedBy=default.target EOF

systemctl --user enable hatsune-monitor systemctl --user start hatsune-monitor

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares itself as a desktop monitor, but the documentation clearly instructs users to run shell commands and install/execute scripts with system-level side effects. Omitting an explicit tool scope or permissions declaration makes the skill's operational power less transparent and increases the risk of users invoking shell-capable behavior without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

cp /path/to/your/chuyin.gif /tmp/chuyin.gif

或者创建 assets 目录

mkdir -p ~/.openclaw/workspace/skills/hatsune-miku-monitor/assets cp /path/to/your/hatsune.gif ~/.openclaw/workspace/skills/hatsune-miku-monitor/assets/

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README promotes a 'one-click acceleration' feature that performs destructive or disruptive actions without prominent warnings about instability, performance regressions, loss of cached state, or operational side effects. Clearing caches, rotating swap, deleting cache directories, and pruning logs can impair troubleshooting, degrade active sessions, and in some environments affect running applications.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The documentation instructs users to modify sudoers for passwordless execution of commands that change kernel cache behavior, disable/enable swap, and prune logs. Granting NOPASSWD access to such commands materially weakens privilege boundaries and can enable abuse, accidental disruption, or repeated destructive actions without meaningful user friction.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

如果想让清理效果更明显，允许无密码执行：

bash

sudo visudo

添加（替换 your_username）：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

启用：

bash

systemctl --user enable hatsune-monitor
systemctl --user start hatsune-monitor

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

# 检查文件
ls -la /tmp/chuyin.gif
# 或
ls -la ~/.openclaw/workspace/skills/hatsune-miku-monitor/assets/

# 安装 Pillow
pip3 install pillow

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

User-facing strings throughout the file, including the window title, labels, buttons, and startup message, are fixed in Chinese. There is no indication that the tool is region-specific or that users can opt into another language, which creates a locale policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation and UI describe the feature as memory-cache cleanup, but the implementation also kills browser processes, manipulates swap, deletes logs, and removes user caches. This understatement undermines informed consent and can cause users to trigger impactful actions they did not agree to.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The boost action kills Chrome renderer processes via pkill, which is a system-modifying operation unrelated to a passive desktop monitor. This can terminate user work, cause data loss in browser tabs/forms, and is triggered from a deceptively simple UI action labeled as acceleration.

Content

Scanner excerpt · scripts/hatsune-ball.py (reported line 356)May include surrounding context.

python

# 2. 清理浏览器缓存（如果有）
        try:
            subprocess.run(['pkill', '-f', 'chrome.*--type=renderer'], 
                          check=False, stderr=subprocess.DEVNULL)
        except:
            pass

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hatsune-ball.py (reported line 363)May include surrounding context.

python

# 3. sync 写入磁盘
        try:
            subprocess.run(['sync'], check=False)
        except:
            pass

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

Using sudo sh -c to write to /proc/sys/vm/drop_caches performs privileged kernel cache manipulation from a consumer-facing monitor UI. This is both a scope mismatch and a dangerous system-changing operation that can harm performance, mislead users about reclaimed memory, and normalize hidden privileged execution.

Content

Scanner excerpt · scripts/hatsune-ball.py (reported line 372)May include surrounding context.

python

for cache_level in [1, 2, 3]:
            try:
                # 尝试无密码 sudo（可能需要配置 sudoers）
                subprocess.run(
                    ['sudo', '-n', 'sh', '-c', f'echo {cache_level} > /proc/sys/vm/drop_caches'],
                    check=False, stderr=subprocess.DEVNULL, timeout=1
                )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

Disabling swap with sudo is a privileged system-management action exposed from a desktop monitor UI. Toggling swap can degrade system stability, trigger memory pressure, and affect unrelated processes, especially if the system is low on RAM.

Content

Scanner excerpt · scripts/hatsune-ball.py (reported line 381)May include surrounding context.

python

# 5. 清理 swap（如果有）
        try:
            subprocess.run(['sudo', '-n', 'swapoff', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
            subprocess.run(['sudo', '-n', 'swapon', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

Re-enabling swap after forcibly disabling it is part of a privileged workflow that changes system memory behavior without informed consent. Even when intended as maintenance, this is risky and inappropriate for a simple monitor because it can disrupt workloads and hide the true scope of the action.

Content

Scanner excerpt · scripts/hatsune-ball.py (reported line 383)May include surrounding context.

python

try:
            subprocess.run(['sudo', '-n', 'swapoff', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
            subprocess.run(['sudo', '-n', 'swapon', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
        except:
            pass