Security audit

clash-auto-switch

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent proxy auto-switching purpose, but it ships unsafe credential handling, injectable shell code, and elevated scheduled-task guidance that users should review before installing.

Install only after reviewing the scripts. Prefer the Python skill path with a unique local Clash secret, keep the controller bound to localhost, avoid passing secrets on command lines or committing them to config files, do not run scheduled tasks as administrator/root, and avoid the bundled shell scripts unless the hardcoded secret, injection bug, and `/tmp` state handling are fixed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: clash-switch.sh:15
Finding: Hardcoded Clash Controller Credential
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: clash-switch.sh:42
Finding: Arbitrary Python Code Execution Through Crafted Proxy Node Names
Content: View full analysis
/dev/null || \ echo "$string" | sed 's/ /%20/g' } ``` The vulnerable function is reached with proxy names retrieved from the Clash API: ```bash test_proxy_delay() { local proxy_name="$1" local encoded_name=$(urlencode "$proxy_name") local delay=$(clash_api_get "/proxies/${encoded_name}/delay?timeout=5000&url=http://www.gstatic.com/generate_204" | jq -r '.delay' 2>/dev/null) ``` ### Technical Analysis The `urlencode` function inserts `$string` directly into Python source passed to `python3 -c`. Shell quoting does not make the resulting Python program safe. A proxy node name containing a terminating triple quote can escape the intended Python string and append attacker-selected Python statements. Proxy names are not inherently trusted. They can originate from imported proxy subscriptions or a compromised Clash controller. Normal auto-selection and latency-testing flows pass these names into `urlencode`, so no direct shell argument from the attacker is required. ### Attack Path 1. An attacker controls or compromises a proxy subscription, or otherwise introduces a crafted node name into the Clash configuration. 2. The crafted name contains Python syntax that closes `'''$string'''` and executes an injected statement. 3. The victim invokes `clash-switch.sh auto`, `list`, a region command, or another path that tests proxy latency. 4. `test_proxy_delay` passes the attacker-controlled node name to `urlencode`. 5. `python3 -c` evaluates the generated source and executes the injected Python code with the privileges of the script process. ### Impact Assessment Successful exploitation provides arbitrary local code execution as the user running the script. ...[truncated 311 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: clash-switch-v2.sh:21
Finding: Predictable Shared Temporary State Enables File Overwrite and Unintended File Reads
Content: View full analysis
"$STATE_FILE" } # 加载状态 load_state() { if [ -f "$STATE_FILE" ]; then cat "$STATE_FILE" else echo "{}" fi } ``` ```bash status) cat $(load_state) ;; ``` ### Technical Analysis The state file uses a fixed name in the globally shared `/tmp` directory. The script performs no ownership, symlink, file-type, or permission validation before redirecting output to that path. A local attacker can pre-create the path as a symbolic link. If a more privileged user later runs `save_state`, shell redirection follows the link and truncates or overwrites the link target. The `status` implementation contains a separate defect: `load_state` prints the contents of the state file, but command substitution passes those contents to `cat` as filenames. Consequently, attacker-controlled whitespace-separated content in the state file can cause the script to read unintended local paths. ### Attack Path **File overwrite path:** 1. A local attacker creates `/tmp/clash-switch-state.json` as a symbolic link to a file writable by the future script process. 2. A privileged user or scheduled task executes the `auto` command. 3. `save_state` redirects JSON output through the symbolic link. 4. The target file is truncated and replaced with state JSON. **File-read path:** 1. A local attacker creates or modifies `/tmp/clash-switch-state.json`. 2. The attacker inserts one or more filesystem paths into its contents. 3. A victim ...[truncated 600 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: README.md:160
Finding: Scheduled Task Documentation Requests Unnecessary Highest Privileges
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: skills/clash-auto-switch/requirements.txt:1
Finding: Unpinned Runtime Dependencies Permit Unaudited Package Resolution
Content: View full analysis
=2.28.0 ``` The documentation also performs registry-based installation without a pinned package version: ```bash pip install requests ``` ```bash npx clawdhub install clash-auto-switch ``` ### Technical Analysis The Python dependency is constrained only by a minimum version. This permits installation of any future `requests` release accepted by the resolver. The documented `pip install requests` command is likewise unpinned. The `npx` installation command also resolves and executes registry-distributed tooling without a version lock in the documented command. This does not prove that the current upstream packages are malicious. The defect is that the installed code can differ from the audited version over time, weakening reproducibility and expanding exposure to registry compromise, account takeover, or malicious future releases. ### Attack Path 1. A user follows the documentation or installs dependencies from `requirements.txt`. 2. The package resolver queries the configured package registry. 3. A future, compromised, or otherwise unsafe version satisfying the broad constraint is selected. 4. Package installation or import executes code not covered by this project audit. 5. That code receives the permissions and environment of the installing or running user. ### Impact Assessment A compromised dependency can execute arbitrary code as the user performing installation or running the Skill. It may access the `CLASH_SECRET`, OpenClaw configuration, local files, and network resources available to that account. If installation is performed from an administrator or root context, the impact becomes system-wide. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/clash-auto-switch/clash.py:21
Finding: Clash Bearer Secret Can Be Sent to Arbitrary Plaintext HTTP Endpoints
Content: View full analysis
Optional[Dict]: """发送 API 请求""" url = f"{self.api_url.rstrip('/')}{endpoint}" try: if method.upper() == "GET": r = requests.get(url, headers=self.headers, timeout=10, **kwargs) elif method.upper() == "PUT": r = requests.put(url, headers=self.headers, timeout=10, **kwargs) ``` ### Technical Analysis Using plaintext HTTP for a controller bound strictly to `127.0.0.1` is a common local-only deployment choice. However, the implementation accepts an arbitrary API URL from command-line arguments or `CLASH_API` and sends the bearer credential to it without validating the scheme or host. If a user configures a non-loopback HTTP controller, the bearer token traverses the network without transport encryption. A network-positioned attacker can observe the authorization header. A maliciously supplied API URL can also deliberately receive the credential. The health-check requests to Telegram, Anthropic, Google, OpenAI, and GitHub do not include this authorization header; the issue is limited to requests made to the configured Clash controller. ### Attack Path 1. The API endpoint is configured ...[truncated 850 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes automatic proxy switching, health checks, and scheduled execution, but does not clearly warn that these operations can change active network routing and affect where user traffic is sent. In a skill context, that omission increases the chance of users enabling unattended behavior that silently alters connectivity, privacy exposure, or service access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx clawdhub install clash-auto-switch without pinning a specific package version. This can cause users to fetch whatever version is current at execution time, increasing supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly supports automated and scheduled execution of /clash auto, which can change active proxy/group selections without an explicit warning that network routing will be modified. In an agent or cron context, this can unexpectedly alter connectivity, traffic paths, and service behavior, making the action security-relevant rather than a harmless status check.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script embeds a hard-coded Clash API bearer token directly in source and then uses it in HTTP requests. Hard-coded secrets are easily exposed through source sharing, backups, logs, shell history, or local file access, allowing unauthorized control of the local proxy manager and potentially traffic redirection or service disruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The switch_to function modifies the active ChatGPT proxy selection through the Clash API, which changes system/application routing behavior. While auto suggests automation, the script does not clearly warn in comments or help text that invoking it will actively change proxy configuration and persist state/log files.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · clash-switch-v2.sh (reported line 94)May include surrounding context.
sh
# 切换节点 switch_to() { local proxy="$1" curl -s -X PUT -H "Authorization: Bearer ${CLASH_SECRET}" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$proxy\"}" \ "${CLASH_API}/proxies/ChatGPT" >/dev/null 2>&1

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code presents its description, docstrings, and runtime/user-facing output in Chinese only, including installation guidance and operational messages. That creates a natural-language locale constraint without user opt-in or justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The top-level documentation says the script '优先选择美国/新加坡节点' (prefer U.S./Singapore nodes), but the actual PREFERRED_REGIONS array contains Singapore, Hong Kong, and Japan markers, with no U.S. entries. This is an active contradiction between documented intent and implemented selection logic, not just an omitted detail.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The script embeds a live Clash controller secret directly in source and uses it in Authorization headers for API calls. Hardcoded secrets are dangerous because anyone with access to the file, logs, backups, or repository can reuse the token to control the local proxy configuration, switch nodes, or inspect controller data; the risk is amplified because the usage output also prints the secret back to the terminal.
Content: Scanner excerpt · clash-switch.sh (reported line 52)May include surrounding context.
sh
# Clash API 调用 clash_api_get() { local endpoint="$1" curl -s -H "Authorization: Bearer ${CLASH_SECRET}" "${CLASH_API}${endpoint}" } clash_api_put() {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The auto_switch flow changes the active proxy configuration automatically when health checks fail, which is a state-changing operation affecting system/network behavior. Although the script logs progress, it does not warn the user in usage/help text or request confirmation before changing the proxy, so the operational impact is not clearly disclosed as a potentially disruptive action.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The installation command uses npx clawdhub install clash-auto-switch without pinning a specific version, which means users may fetch whatever package version is current at install time. This creates a supply-chain risk: a compromised publisher account, malicious update, or unexpected breaking change could be pulled automatically and executed in the user's environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide instructs users to place CLASH_SECRET into a configuration file but does not warn that it is a sensitive credential or advise how to protect it. If that file is committed to source control, shared, logged, or exposed through local compromise, an attacker could use the secret to control the Clash API and alter proxy behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation encourages scheduled automatic execution of /clash auto, which changes proxy/network routing state without per-use confirmation or explicit safety notes. In practice this can silently redirect traffic, disrupt expected connectivity, or interfere with security/compliance assumptions about which network path is being used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents automatic proxy switching but does not warn users that changing active proxy groups can disrupt ongoing connections, alter routing, or affect application behavior. In a networking skill, silent configuration changes are security-relevant because they can unexpectedly redirect traffic and interfere with user expectations about connectivity and session stability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-facing strings throughout the file, including installation guidance, error messages, help text, and operational status messages, are written only in Chinese. For a general-purpose skill, this creates a language/locale policy issue because the skill does not provide user opt-in, selection, or justification for restricting interactions to a single language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file contains feature descriptions entirely in Chinese, which can constitute a language/locale policy issue when the skill documentation does not offer a user language choice or explain a required locale. The file does not indicate that the project is region-specific or that Chinese is an intentional, documented constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The file is named README.md and includes an English language toggle link, but nearly all instructional content is written in Chinese. This can be a language/locale policy issue because users are not given an explicit language choice within the file content they open by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The documentation instructs users to supply a Clash API secret via command line or environment variables but provides no guidance on secure handling of that credential. This increases the risk of accidental exposure through shell history, logs, process inspection, screenshots, or insecure environment management, especially in shared or automated environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: User-facing comments, status messages, and help output are all written in Chinese, with no option to select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The header comment explicitly lists '通知支持 - 切换成功/失败时发送通知' as a new feature. However, the script only logs to a file/stdout and updates a state file; there is no mail, webhook, desktop notification, or other notification mechanism anywhere in the code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Comments and configuration define preferred regions as Singapore/Hong Kong/Japan, and later commands expose only US and Singapore regional switching. This imposes locale-specific behavior by default rather than presenting it as a user-selectable policy, which can conflict with language/locale choice expectations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The region_switch function and usage help present U.S./Singapore as supported manual regions, but elsewhere the automatic-selection logic is documented as preferring U.S./Singapore while actually preferring Singapore/Hong Kong/Japan. This creates conflicting intent signals in the file about how regional preference works.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The natural-language instructions throughout the file are Chinese-only, and there is no indication that the user can choose another language or that the locale constraint is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation instructs users to configure an API secret via command line and environment variables but provides no warning that these values are sensitive and should not be logged, shared, or committed to files. This increases the chance of accidental credential exposure through shell history, screenshots, process listings, or configuration leakage.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is specified as requests>=2.28.0, which permits installation of many different future or older-compatible versions rather than a known-good release. This weakens reproducibility and can unintentionally pull in a vulnerable or breaking version during install, especially in automated environments.
Content: Scanner excerpt · skills/clash-auto-switch/requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0

Static analysis

No suspicious patterns detected.