ClawHub
Back to skill

Security audit

Llmfit Advisor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-only helper for using llmfit to recommend local LLM models, with some supply-chain and transparency notes but no artifact-backed malicious behavior.

Install only if you are comfortable letting llmfit inspect local hardware details such as CPU, RAM, and GPU information for recommendations. If using Docker, prefer a pinned, verified image tag or digest instead of the unpinned example, and review any upstream update script before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:185
Finding

Execution of an Unpinned Remote Container Image

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 185-189
Vulnerability Type: Unpinned third-party container dependency
Risk Level: Medium

Vulnerable Code:

powershell
### Q: 如何在 Docker 中使用？
**A**: 使用官方 Docker 镜像：
```powershell
docker run ghcr.io/alexsjones/llmfit --version
text

### Technical Analysis

The documented `docker run` command references `ghcr.io/alexsjones/llmfit` without an immutable digest or an explicit version tag. Docker consequently resolves the reference to the registry's default tag, normally `latest`. The content associated with that mutable tag may change after the skill has been audited.

This creates a supply-chain risk because following the documentation can download and execute container code that was not part of the reviewed project. A registry-account compromise, unauthorized image replacement, or unreviewed upstream release could alter the effective payload.

### Attack Path

1. An attacker compromises the upstream registry account, publishing process, or mutable default image tag.
2. The attacker replaces or updates the referenced image with a malicious image.
3. A user follows the skill documentation and runs `docker run ghcr.io/alexsjones/llmfit --version`.
4. Docker retrieves the altered image and starts its configured entry point locally.
5. The malicious process executes with the permissions and resources granted to the container.

### Impact Assessment

The altered image could execute arbitrary code within the container, consume host CPU, memory, storage, and network resources, or access any capabilities and resources exposed by the local Docker configuration. The shown command does not explicitly mount host directories, expose credentials, request privileged mode, or mount the Docker socket, which limits the direct host-access scope. Impact would increase if the environment applies permissive defaults, supplies credentials, or contains a vulnerable co
...[truncated 16 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the container to a reviewed release and immutable digest, for example:
    powershell
    docker run --rm ghcr.io/alexsjones/llmfit:0.9.8@sha256:<verified-digest> --version
  • Obtain the digest from a trusted release channel and verify it independently before documenting it.
  • Enable signature or provenance verification with an appropriate container verification tool.
  • Use --rm to remove the stopped container after execution.
  • Apply least-privilege container controls, such as a non-root user, dropped Linux capabilities, a read-only filesystem, and restricted networking where compatible.
  • Establish a controlled process for reviewing and updating the pinned version and digest.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation instructs users to run a container image from GHCR without pinning a specific tag or immutable digest. This creates a supply-chain risk because future image updates or a compromised latest/default tag could cause users to execute unexpected code with the privileges of Docker on their system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

All user-facing documentation and example interactions in this skill are presented only in Chinese, with no indication that other languages are supported or that Chinese is optional. The policy requires flagging language or locale constraints when a skill appears to force a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill emphasizes automatic hardware detection but does not clearly warn users that local system hardware information will be inspected. While this is not code execution, it is a transparency and privacy issue because users may not realize the skill gathers system details such as CPU, RAM, and GPU characteristics before consenting.

Content

No source excerpt is available for this finding.