Hatsune Miku Monitor

• Outcome: Review
• Latest audit: May 29, 2026 · 9:28 PM UTC
• Version: 1.0.1

Overview

This is mostly a desktop monitor, but its one-click boost can kill browser processes, delete caches and logs, and run privileged system maintenance commands.

Install only if you intentionally want the cleanup behavior, not just a passive monitor. Do not add the suggested NOPASSWD sudo rules unless you accept passwordless cache, swap, and journal operations; treat the boost button as a system-maintenance action that may interrupt browser work, delete caches, change swap state, and remove recent system logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 2. 清理浏览器缓存（如果有）
        try:
            subprocess.run(['pkill', '-f', 'chrome.*--type=renderer'], 
                          check=False, stderr=subprocess.DEVNULL)
        except:
            pass

• Confidence: 97% confidence
• Finding: subprocess.run(['pkill', '-f', 'chrome.*--type=renderer'], check=False, stderr=subprocess.DEVNULL)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 5. 清理 swap（如果有）
        try:
            subprocess.run(['sudo', '-n', 'swapoff', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
            subprocess.run(['sudo', '-n', 'swapon', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)

• Confidence: 98% confidence
• Finding: subprocess.run(['sudo', '-n', 'swapoff', '-a'], check=False, stderr=subprocess.DEVNULL, timeout=2)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            subprocess.run(['sudo', '-n', 'swapoff', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
            subprocess.run(['sudo', '-n', 'swapon', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
        except:
            pass

• Confidence: 96% confidence
• Finding: subprocess.run(['sudo', '-n', 'swapon', '-a'], check=False, stderr=subprocess.DEVNULL, timeout=2)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 6. 清理 journalctl 日志
        try:
            subprocess.run(['sudo', '-n', 'journalctl', '--vacuum-time=1d'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=3)
        except:
            pass

• Confidence: 95% confidence
• Finding: subprocess.run(['sudo', '-n', 'journalctl', '--vacuum-time=1d'], check=False, stderr=subprocess.DEVNULL, timeout=3)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for cache_level in [1, 2, 3]:
            try:
                # 尝试无密码 sudo（可能需要配置 sudoers）
                subprocess.run(
                    ['sudo', '-n', 'sh', '-c', f'echo {cache_level} > /proc/sys/vm/drop_caches'],
                    check=False, stderr=subprocess.DEVNULL, timeout=1
                )

• Confidence: 99% confidence
• Finding: subprocess.run( ['sudo', '-n', 'sh', '-c', f'echo {cache_level} > /proc/sys/vm/drop_caches'], check=False, stderr=subprocess.DEVNULL, timeout=1

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation shows shell-capable behavior, including installation, startup, cleanup, and privileged system maintenance commands, but no explicit permissions are declared. That mismatch increases the chance users or the platform will execute impactful actions without adequate consent boundaries or review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The advertised function is a cute desktop monitor, but the described behavior includes process termination, cache dropping, swap cycling, log vacuuming, and cache deletion. This is materially broader and more destructive than users would expect from a monitoring tool, creating risk of misleading consent and unsafe execution of system-altering actions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest describes a desktop monitor, but the implementation includes system-cleaning, process termination, cache dropping, swap manipulation, log deletion, and filesystem cleanup. This mismatch is dangerous because users may trust the skill as passive/observational while it actually performs invasive and potentially destructive host changes.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill executes host maintenance commands that are unjustified for a desktop monitor, including pkill, cache dropping, swap management, and journal cleanup. Skill context makes this more dangerous because the declared use case lowers user suspicion while the code performs broad administrative actions on the local machine.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Deleting and recreating user cache directories is a destructive file operation that can remove useful local state, trigger application regressions, and create unexpected side effects. In the context of a monitor widget, this is outside expected behavior and is not justified by the advertised purpose.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The comments and UI describe the feature as simple memory-cache cleanup, but the implementation performs much broader administrative actions such as killing processes, changing swap state, vacuuming logs, and deleting files. This deceptive framing undermines informed consent and increases the likelihood that users trigger harmful actions they did not intend.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The one-click cleanup section describes actions that can affect performance, availability, logs, and cached user data, but it does not clearly warn about side effects or recovery limitations. Users may trigger disruptive maintenance believing it is a safe optimization, when some actions can degrade responsiveness or remove diagnostically useful data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documentation recommends passwordless sudo for commands that alter kernel cache state, disable and re-enable swap, and vacuum logs. Encouraging NOPASSWD for broad administrative commands weakens host security and can allow unintended or repeated privileged execution with little friction.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Destructive cleanup actions are bound to a single button without any user-facing warning about process termination, privileged system changes, log deletion, or cache removal. This lack of disclosure is dangerous because users can trigger irreversible or destabilizing operations under the mistaken belief that the button is a harmless optimization.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

sudo dnf install -y python3-gobject gtk3
elif command -v pacman &> /dev/null; then
    echo "📦 安装 GTK 依赖..."
    sudo pacman -S --noconfirm python-gobject gtk3
else
    echo "⚠️  未知的包管理器，请手动安装 python3-gi 和 gtk3"
fi

• Confidence: 82% confidence
• Finding: --noconfirm

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo dnf install -y python3-gobject gtk3
elif command -v pacman &> /dev/null; then
    echo "📦 安装 GTK 依赖..."
    sudo pacman -S --noconfirm python-gobject gtk3
else
    echo "⚠️  未知的包管理器，请手动安装 python3-gi 和 gtk3"
fi

• Confidence: 77% confidence
• Finding: sudo

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "python": ">=3.6",
    "gtk": ">=3.0",
    "psutil": "*",
    "pillow": "*"
  }
}

• Confidence: 95% confidence
• Finding: "psutil": "*"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"python": ">=3.6",
    "gtk": ">=3.0",
    "psutil": "*",
    "pillow": "*"
  }
}

• Confidence: 95% confidence
• Finding: "pillow": "*"

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo dnf install -y python3-gobject gtk3
elif command -v pacman &> /dev/null; then
    echo "📦 安装 GTK 依赖..."
    sudo pacman -S --noconfirm python-gobject gtk3
else
    echo "⚠️  未知的包管理器，请手动安装 python3-gi 和 gtk3"
fi

• Confidence: 88% confidence
• Finding: --noconfirm

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.