Hatsune Miku Monitor

• Outcome: Review
• Latest audit: May 28, 2026 · 2:18 PM UTC
• Version: 1.0.1

Overview

This is mostly a desktop monitor, but its one-click boost can kill browser processes, delete caches and logs, and run privileged system maintenance commands.

Install only if you intentionally want the cleanup behavior, not just a passive monitor. Do not add the suggested NOPASSWD sudo rules unless you accept passwordless cache, swap, and journal operations; treat the boost button as a system-maintenance action that may interrupt browser work, delete caches, change swap state, and remove recent system logs.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 2. 清理浏览器缓存（如果有）
        try:
            subprocess.run(['pkill', '-f', 'chrome.*--type=renderer'], 
                          check=False, stderr=subprocess.DEVNULL)
        except:
            pass

• Confidence: 97% confidence
• Finding: The 'one-click boost' action kills Chrome renderer processes via pkill, which is a state-changing and potentially destructive operation unrelated to passive system monitoring. Even without shell injection, terminating user applications can cause data loss, disrupt browsing sessions, and exceed the expected permissions/scope of this skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 5. 清理 swap（如果有）
        try:
            subprocess.run(['sudo', '-n', 'swapoff', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
            subprocess.run(['sudo', '-n', 'swapon', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)

• Confidence: 98% confidence
• Finding: Attempting to run sudo swapoff -a disables swap across the system, which can destabilize the host, cause memory pressure, and affect other applications or users. A desktop monitor is not expected to perform privileged memory-management operations, so this creates an unjustified and potentially harmful administrative capability.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            subprocess.run(['sudo', '-n', 'swapoff', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
            subprocess.run(['sudo', '-n', 'swapon', '-a'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=2)
        except:
            pass

• Confidence: 96% confidence
• Finding: Running sudo swapon -a reconfigures system swap state and pairs with swapoff in a way that alters core OS memory management. Even if intended as optimization, this is privileged host modification outside the declared purpose of a monitor and can interfere with system stability and other workloads.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 6. 清理 journalctl 日志
        try:
            subprocess.run(['sudo', '-n', 'journalctl', '--vacuum-time=1d'], 
                          check=False, stderr=subprocess.DEVNULL, timeout=3)
        except:
            pass

• Confidence: 95% confidence
• Finding: Invoking sudo journalctl --vacuum-time=1d deletes older journal logs, reducing forensic visibility and modifying system state. For a monitoring widget, log retention changes are unrelated to core functionality and can hinder troubleshooting or incident investigation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for cache_level in [1, 2, 3]:
            try:
                # 尝试无密码 sudo（可能需要配置 sudoers）
                subprocess.run(
                    ['sudo', '-n', 'sh', '-c', f'echo {cache_level} > /proc/sys/vm/drop_caches'],
                    check=False, stderr=subprocess.DEVNULL, timeout=1
                )

• Confidence: 99% confidence
• Finding: The code attempts privileged writes to /proc/sys/vm/drop_caches via sudo sh -c, which explicitly alters kernel cache behavior on the host. This is a powerful system-administration action disguised as a performance button, and if passwordless sudo is available it can unexpectedly impact system performance, diagnostics, and workload behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation shows shell-capable behavior, including installation, startup, cleanup, and privileged system maintenance commands, but no explicit permissions are declared. That mismatch increases the chance users or the platform will execute impactful actions without adequate consent boundaries or review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The advertised function is a cute desktop monitor, but the described behavior includes process termination, cache dropping, swap cycling, log vacuuming, and cache deletion. This is materially broader and more destructive than users would expect from a monitoring tool, creating risk of misleading consent and unsafe execution of system-altering actions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest describes a desktop monitor, but the implementation includes system-cleaning, process termination, cache dropping, swap manipulation, log deletion, and filesystem cleanup. This mismatch is dangerous because users may trust the skill as passive/observational while it actually performs invasive and potentially destructive host changes.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill executes host maintenance commands that are unjustified for a desktop monitor, including pkill, cache dropping, swap management, and journal cleanup. Skill context makes this more dangerous because the declared use case lowers user suspicion while the code performs broad administrative actions on the local machine.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Deleting and recreating user cache directories is a destructive file operation that can remove useful local state, trigger application regressions, and create unexpected side effects. In the context of a monitor widget, this is outside expected behavior and is not justified by the advertised purpose.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The comments and UI describe the feature as simple memory-cache cleanup, but the implementation performs much broader administrative actions such as killing processes, changing swap state, vacuuming logs, and deleting files. This deceptive framing undermines informed consent and increases the likelihood that users trigger harmful actions they did not intend.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The one-click cleanup section describes actions that can affect performance, availability, logs, and cached user data, but it does not clearly warn about side effects or recovery limitations. Users may trigger disruptive maintenance believing it is a safe optimization, when some actions can degrade responsiveness or remove diagnostically useful data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documentation recommends passwordless sudo for commands that alter kernel cache state, disable and re-enable swap, and vacuum logs. Encouraging NOPASSWD for broad administrative commands weakens host security and can allow unintended or repeated privileged execution with little friction.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Destructive cleanup actions are bound to a single button without any user-facing warning about process termination, privileged system changes, log deletion, or cache removal. This lack of disclosure is dangerous because users can trigger irreversible or destabilizing operations under the mistaken belief that the button is a harmless optimization.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

sudo dnf install -y python3-gobject gtk3
elif command -v pacman &> /dev/null; then
    echo "📦 安装 GTK 依赖..."
    sudo pacman -S --noconfirm python-gobject gtk3
else
    echo "⚠️  未知的包管理器，请手动安装 python3-gi 和 gtk3"
fi

• Confidence: 82% confidence
• Finding: Using pacman's --noconfirm suppresses interactive review and allows package installation to proceed automatically with elevated privileges. In an agent skill or install script context, this reduces user oversight and increases the risk of unintended or unsafe system changes if package names, repositories, or environment state are manipulated.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo dnf install -y python3-gobject gtk3
elif command -v pacman &> /dev/null; then
    echo "📦 安装 GTK 依赖..."
    sudo pacman -S --noconfirm python-gobject gtk3
else
    echo "⚠️  未知的包管理器，请手动安装 python3-gi 和 gtk3"
fi

• Confidence: 77% confidence
• Finding: This sudo pacman command combines root execution with fully automatic confirmation, which weakens the user's ability to review privileged changes before they occur. In a skill-distributed install script, this makes the action more dangerous because users may execute it as-is without understanding the exact system modifications being performed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "python": ">=3.6",
    "gtk": ">=3.0",
    "psutil": "*",
    "pillow": "*"
  }
}

• Confidence: 95% confidence
• Finding: The dependency `psutil` is specified as `*`, which allows any version to be installed, including future releases with breaking changes or potentially compromised versions from the package ecosystem. In this skill, the install script directly invokes `pip3 install psutil pillow`, so unpinned dependency resolution increases supply-chain risk during installation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"python": ">=3.6",
    "gtk": ">=3.0",
    "psutil": "*",
    "pillow": "*"
  }
}

• Confidence: 95% confidence
• Finding: The dependency `pillow` is specified as `*`, permitting installation of any available version. Because the package also includes an installation script that fetches dependencies from the package index at install time, this creates avoidable supply-chain exposure if an unsafe or incompatible release is pulled.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo dnf install -y python3-gobject gtk3
elif command -v pacman &> /dev/null; then
    echo "📦 安装 GTK 依赖..."
    sudo pacman -S --noconfirm python-gobject gtk3
else
    echo "⚠️  未知的包管理器，请手动安装 python3-gi 和 gtk3"
fi

• Confidence: 88% confidence
• Finding: The --noconfirm flag is a tool-parameter abuse pattern because it disables pacman's safety prompt during a root-level package install. In this context, an install script shipped as part of a desktop utility skill is more dangerous because it can normalize unattended privileged changes and reduce the chance that a user notices unexpected package actions or repository issues.

Static analysis

No suspicious patterns detected.