Security audit

JishuDB Setup / JishuDB 安装连接助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed JishuDB installer/connector that uses high-impact local installation steps, but its artifacts keep them scoped to reviewed helpers, fixed release sources, explicit approval, and user consent gates.

Install only if you intend to let an agent download, install, and launch JishuDB Desktop and edit the selected MCP client configuration. Review the helper approval envelope carefully, especially release source, paths, profile, and the unsigned Windows publisher notice; do not provide OAuth codes or tokens in chat.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (21)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
- Windows x64: `scripts/install-windows.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
- Windows x64: `scripts/install-windows.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 441)May include surrounding context.
md
- Windows x64: `scripts/install-windows.js`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/install-macos.sh (reported line 1188)May include surrounding context.
sh
assert_digest "$partial_path" "$expected_sha" installer cnb_revalidate_approval /bin/mv -- "$partial_path" "$installer_path" /bin/rm -f -- "${root}/download-location.txt" fi jxa result download "$PLAN_PATH" "$PLAN_SHA256" "$offset" "$added" }

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to use shell execution, network access, environment/proxy settings, and local file manipulation, but it declares no corresponding tool scope or permission boundaries. That creates a real least-privilege gap: a host may expose broader capabilities than intended, and users/reviewers are not given a machine-readable restriction on what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.
md
- `route=password-login`: retain ordinary browser login and OAuth consent. - `route=password-setup`, `route=unavailable`, a missing field, or an unknown schema: explain that the current installation may require ordinary app setup. Do not promise passwordless onboarding, silently upgrade, or disable verification. Browser consent and client connection are separate completion steps. If the browser shows "authorized" but remains on the handoff page, direct the user to

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.
md
| Observation | Check and recovery | | --- | --- | | No host entry or wrong effective entry | Locate the configuration actually loaded by the client. Resolve overlapping scopes or overrides before editing. Offer a target choice if unresolved. | | File contains JishuDB but the host's MCP list does not | This is an unloaded configuration, not yet an OAuth failure. Use the host's supported reload/refresh or configuration-save action and read its list back. If no such action is exposed, return `USER_ACTION_REQUIRED` for a safe user-operated reload/import or restart. Do not ask the user to trust an entry that has not appeared. | | DNS failure, no route, or connection timeout | Verify the selected host and service reachability from the client. Ask for an updated address or restoration of the required network only when needed. A private IP or timeout does not prove a VPN or subnet cause. | | Local connection refused | Resolve `desktop-endpoint.json`; check the installed app and listener. Start the existing app within the authorized scope and current user's desktop session. An SSH service-session process is not proof of a working desktop launch. | | App uninstalled; endpoint or data-location JSON remains | Preserve the files. The endpoint is a port preference; the data bootstrap locates retained data. Use the installation helper's reviewed plan: valid retained data selects an interactive data-preserving reinstall, while an endpoint alone can be reused by a fresh install. Do not delete data or configuration to satisfy fresh-install checks. |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/connection-recovery.md (reported line 45)May include surrounding context.
md
| Observation | Check and recovery | | --- | --- | | No host entry or wrong effective entry | Locate the configuration actually loaded by the client. Resolve overlapping scopes or overrides before editing. Offer a target choice if unresolved. | | File contains JishuDB but the host's MCP list does not | This is an unloaded configuration, not yet an OAuth failure. Use the host's supported reload/refresh or configuration-save action and read its list back. If no such action is exposed, return `USER_ACTION_REQUIRED` for a safe user-operated reload/import or restart. Do not ask the user to trust an entry that has not appeared. | | DNS failure, no route, or connection timeout | Verify the selected host and service reachability from the client. Ask for an updated address or restoration of the required network only when needed. A private IP or timeout does not prove a VPN or subnet cause. | | Local connection refused | Resolve `desktop-endpoint.json`; check the installed app and listener. Start the existing app within the authorized scope and current user's desktop session. An SSH service-session process is not proof of a working desktop launch. | | App uninstalled; endpoint or data-location JSON remains | Preserve the files. The endpoint is a port preference; the data bootstrap locates retained data. Use the installation helper's reviewed plan: valid retained data selects an interactive data-preserving reinstall, while an endpoint alone can be reused by a fresh install. Do not delete data or configuration to satisfy fresh-install checks. |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/install-macos-cnb.cjs (reported line 49)May include surrounding context.
js
if (matches.length !== 1) throw new Error(label + ' must exist exactly once'); const asset = matches[0]; assetDigest(asset, label); const expected = 'https://api.github.com/repos/x-aijishu/jishudb-desktop-releases/releases/assets/' + asset.id; if (asset.url !== expected) throw new Error(label + ' API URL is not canonical'); return asset; }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/install-macos-cnb.cjs (reported line 309)May include surrounding context.
js
if (matches.length !== 1) throw new Error(label + ' must exist exactly once'); const asset = matches[0]; assetDigest(asset, label); const expected = 'https://api.github.com/repos/x-aijishu/jishudb-desktop-releases/releases/assets/' + asset.id; if (asset.url !== expected) throw new Error(label + ' API URL is not canonical'); return asset; }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/install-macos.sh (reported line 206)May include surrounding context.
sh
if (matches.length !== 1) throw new Error(label + ' must exist exactly once'); const asset = matches[0]; assetDigest(asset, label); const expected = 'https://api.github.com/repos/x-aijishu/jishudb-desktop-releases/releases/assets/' + asset.id; if (asset.url !== expected) throw new Error(label + ' API URL is not canonical'); return asset; }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/install-macos.sh (reported line 529)May include surrounding context.
sh
if (matches.length !== 1) throw new Error(label + ' must exist exactly once'); const asset = matches[0]; assetDigest(asset, label); const expected = 'https://api.github.com/repos/x-aijishu/jishudb-desktop-releases/releases/assets/' + asset.id; if (asset.url !== expected) throw new Error(label + ' API URL is not canonical'); return asset; }

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/install-macos.sh (reported line 932)May include surrounding context.
sh
[[ ! -e "$endpoint_path" ]] || fail "endpoint_conflict" "Desktop endpoint configuration appeared before launch" /usr/bin/printf '{\n "localPort": %d,\n "schemaVersion": %d\n}\n' "$port" "$ENDPOINT_CONFIG_SCHEMA" > "$endpoint_path" || fail "endpoint_persistence_failed" "Desktop endpoint could not be persisted" /bin/chmod 600 "$endpoint_path" } run_plan() {

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/install-macos.sh (reported line 1003)May include surrounding context.
sh
[[ ! -e "$endpoint_path" ]] || fail "endpoint_conflict" "Desktop endpoint configuration appeared before launch" /usr/bin/printf '{\n "localPort": %d,\n "schemaVersion": %d\n}\n' "$port" "$ENDPOINT_CONFIG_SCHEMA" > "$endpoint_path" || fail "endpoint_persistence_failed" "Desktop endpoint could not be persisted" /bin/chmod 600 "$endpoint_path" } run_plan() {

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install-macos.sh (reported line 1261)May include surrounding context.
sh
validate_bundle_symlinks "${mount_point}/JishuDB.app" "mounted application bundle" [[ -z "$signed_team" ]] || verify_signed_artifact "${mount_point}/JishuDB.app" "$signed_team" app local bundle_id bundle_version runtime_binary bundle_id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "${mount_point}/JishuDB.app/Contents/Info.plist") bundle_version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${mount_point}/JishuDB.app/Contents/Info.plist") [[ "$bundle_id" == "com.aijishu.jishudb" && "$bundle_version" == "$version" ]] || fail "installer_content_invalid" "bundle identity or version does not match the plan" runtime_binary="${mount_point}/JishuDB.app/Contents/Resources/runtime/jishudb"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install-macos.sh (reported line 1262)May include surrounding context.
sh
validate_bundle_symlinks "${mount_point}/JishuDB.app" "mounted application bundle" [[ -z "$signed_team" ]] || verify_signed_artifact "${mount_point}/JishuDB.app" "$signed_team" app local bundle_id bundle_version runtime_binary bundle_id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "${mount_point}/JishuDB.app/Contents/Info.plist") bundle_version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${mount_point}/JishuDB.app/Contents/Info.plist") [[ "$bundle_id" == "com.aijishu.jishudb" && "$bundle_version" == "$version" ]] || fail "installer_content_invalid" "bundle identity or version does not match the plan" runtime_binary="${mount_point}/JishuDB.app/Contents/Resources/runtime/jishudb"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install-macos.sh (reported line 1261)May include surrounding context.
sh
validate_bundle_symlinks "${mount_point}/JishuDB.app" "mounted application bundle" [[ -z "$signed_team" ]] || verify_signed_artifact "${mount_point}/JishuDB.app" "$signed_team" app local bundle_id bundle_version runtime_binary bundle_id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "${mount_point}/JishuDB.app/Contents/Info.plist") bundle_version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${mount_point}/JishuDB.app/Contents/Info.plist") [[ "$bundle_id" == "com.aijishu.jishudb" && "$bundle_version" == "$version" ]] || fail "installer_content_invalid" "bundle identity or version does not match the plan" runtime_binary="${mount_point}/JishuDB.app/Contents/Resources/runtime/jishudb"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install-macos.sh (reported line 1262)May include surrounding context.
sh
validate_bundle_symlinks "${mount_point}/JishuDB.app" "mounted application bundle" [[ -z "$signed_team" ]] || verify_signed_artifact "${mount_point}/JishuDB.app" "$signed_team" app local bundle_id bundle_version runtime_binary bundle_id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "${mount_point}/JishuDB.app/Contents/Info.plist") bundle_version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${mount_point}/JishuDB.app/Contents/Info.plist") [[ "$bundle_id" == "com.aijishu.jishudb" && "$bundle_version" == "$version" ]] || fail "installer_content_invalid" "bundle identity or version does not match the plan" runtime_binary="${mount_point}/JishuDB.app/Contents/Resources/runtime/jishudb"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The helper defines removeFileQuietly and removeDirectoryQuietly using fs.rmSync(..., { force: true, recursive: true }) and intentionally suppresses all errors, but these deletion behaviors have no user-facing prompt, log, or warning in this code file. Because the script later invokes these functions to remove probe, evidence, and plan directories, users are not explicitly informed that local filesystem content will be deleted as part of execution.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/install-windows.js (reported line 1683)May include surrounding context.
js
offset = fs.existsSync(installerPath) ? (await assertDownloadFile(installerPath, context)).size : 0; if (offset > plan.assets.installer.size) fail('invalid_download_cache', 'partial installer exceeds the approved size'); const snapshotPath = path.join(transactionRoot, 'download-release.json'); if (sourceInfo && offset > 0 && !fs.existsSync(snapshotPath)) fail('invalid_download_cache', 'partial mirror cache has no approval binding'); if (fs.existsSync(snapshotPath)) { const snapshot = await readDownloadJson(snapshotPath, context); if (sourceInfo && (snapshot.approvalSha256 !== approvalSha256 || snapshot.catalogSha256 !== sha256Bytes(sourceInfo.catalogBytes))) fail('invalid_download_cache', 'cached release belongs to another approval');

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The script launches a Windows installer via childProcess.spawnSync with silent install flags (/S) and no accompanying console output, confirmation prompt, or other direct user-facing disclosure in this file at the execution point. Although the operation is central to an install helper, this specific code path gives no immediate warning that an external installer will now run and modify the system.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/install-windows.js:1956

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/install-windows.js:447