Security audit
Security checks for vulnerabilities and agentic risk
This download guide needs review because some examples weaken security checks, risk exposing credentials, and change settings beyond the current task.
Remove the trusted-host defaults before use. Keep changes limited to the requested project or command, approve permanent settings explicitly, and verify downloads against independently trusted hashes. Use third-party proxies only for public URLs without secrets. Redact diagnostic values and keep authenticated configuration out of container images.
SKILL.mdT09: Insecure Skill Coding Practices in SKILL.md
Substituted source distributions can execute attacker-controlled build code during installation; substituted packages can execute code when imported, including during the prescribed post-install import check.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## 行动准则（先读这 5 条）
1. **默认中国网络**：任何下载动作前，先判断有无国内镜像；有则用镜像，不要直接打官方源试运气。
2. **优先项目级、其次会话级、最后全局**：`.npmrc` / `pip.conf` 优先于 `npm config set -g` / 全局 `pip.conf`；临时任务用环境变量即可，不要污染用户全局配置。
3. **回退链固定**：主镜像失败 → 备用镜像（≥2 个厂商）→ 官方源 + 代理。每一步都要看 exit code，不要一次失败就宣称环境不支持。
4. **不降级安全性**：镜像只改"地址"，不改校验。`--trusted-host` 仅在 HTTPS 证书确实不通时使用；下载二进制必须校验 sha256 / 签名。
5. **不动业务语义**：只改下载通道。禁止为了"能下"而改 `go.mod` / `package.json` / `pom.xml` 的依赖版本、关掉 lockfile 校验、或 `--force` 覆盖已有产物（除非用户明确要求）。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Python pip | `https://pypi.tuna.tsinghua.edu.cn/simple` → 403 则 `https://mirrors.cloud.tencent.com/pypi/simple` | `-i` 或 `PIP_INDEX_URL` |
| Python uv | 同上 + `UV_DEFAULT_INDEX` | `UV_PYTHON_INSTALL_MIRROR`（装 Python 本体）|
| conda / mamba | `https://mirrors.tuna.tsinghua.edu.cn/anaconda` | `~/.condarc` channels |
| Node npm | `https://registry.npmmirror.com` | `--registry` / `.npmrc` |
| pnpm / yarn | 同上 | `.npmrc` 同源 |
| Node 二进制 / nvm | `https://npmmirror.com/mirrors/node/` | `NVM_NODEJS_ORG_MIRROR` |
| Go modules | `https://goproxy.cn,direct` | `GOPROXY` + `GOSUMDB=sum.golang.google.cn` |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Python uv | 同上 + `UV_DEFAULT_INDEX` | `UV_PYTHON_INSTALL_MIRROR`（装 Python 本体）|
| conda / mamba | `https://mirrors.tuna.tsinghua.edu.cn/anaconda` | `~/.condarc` channels |
| Node npm | `https://registry.npmmirror.com` | `--registry` / `.npmrc` |
| pnpm / yarn | 同上 | `.npmrc` 同源 |
| Node 二进制 / nvm | `https://npmmirror.com/mirrors/node/` | `NVM_NODEJS_ORG_MIRROR` |
| Go modules | `https://goproxy.cn,direct` | `GOPROXY` + `GOSUMDB=sum.golang.google.cn` |
| Rust cargo | `https://rsproxy.cn/index/` | `~/.cargo/config.toml` + sparse 协议 |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
.npmrc）registry=https://registry.npmmirror.com
electron_mirror=https://npmmirror.com/mirrors/electron/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
常见失效原因：
- `pip.conf` 放错位置（Linux `~/.config/pip/pip.conf`、macOS `~/Library/Application Support/pip/pip.conf`、Windows `%APPDATA%\pip\pip.ini`）。
- `.npmrc` 被 `--registry` 或 CI 的 `NPM_CONFIG_REGISTRY` 覆盖；或 pnpm 用了自己的 `pnpm config` 作用域。
- `~/.cargo/config`（旧名，无扩展）与 `config.toml` 同时存在 → 旧文件优先，改了新的没反应。
- Gradle 的 `init.gradle` 放在 `~/.gradle/init.d/` 才自动加载（放 `~/.gradle/init.gradle` 需要 `--init-script`）。
- 容器内构建不继承宿主的 daemon.json / `.npmrc`，要在 `Dockerfile` 里显式复制或传 `--build-arg`。
Dependency resolution is redirected away from a canonical default, adds another source, or uses a destination that cannot be resolved statically.
export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple
Dependency resolution is redirected away from a canonical default, adds another source, or uses a destination that cannot be resolved statically.
export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple
The template unconditionally exports PIP_TRUSTED_HOST for the primary mirror, allowing pip to trust that host without valid HTTPS certificate verification. An attacker able to intercept traffic could substitute package metadata or artifacts; the general advice to preserve verification does not neutralize this concrete setting.
This is the same certificate-verification bypass identified by SDI-4, not a separate underlying vulnerability. Although the prose limits trusted-host usage to certificate problems, the copyable template enables it unconditionally and exports it to subsequent child processes.
Dependency resolution is redirected away from a canonical default, adds another source, or uses a destination that cannot be resolved statically.
export NPM_CONFIG_REGISTRY=https://registry.npmmirror.com
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
local url="$1" out="${2:-$(basename "$url")}"
for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do
echo ">> ${p:-direct}$url"
curl -fL --retry 3 --connect-timeout 10 -m 600 "$p$url" -o "$out.part" && mv "$out.part" "$out" && { echo "OK: $out"; return 0; }
rm -f "$out.part"
done
echo "ALL MIRRORS FAILED: $url" >&2; return 1
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
local url="$1" out="${2:-$(basename "$url")}"
for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do
echo ">> ${p:-direct}$url"
curl -fL --retry 3 --connect-timeout 10 -m 600 "$p$url" -o "$out.part" && mv "$out.part" "$out" && { echo "OK: $out"; return 0; }
rm -f "$out.part"
done
echo "ALL MIRRORS FAILED: $url" >&2; return 1
Code pulls a container image with signature or registry verification disabled (--disable-content-trust, DOCKER_CONTENT_TRUST=0, --insecure-registry). This accepts tampered or unverified images and is a container supply-chain risk.
## 5. 硬约束清单
- `uv` / `pip` 混用同一 `PIP_INDEX_URL` 会互相干扰：跑 uv 时显式带 `--default-index`，别只依赖全局 env。
- 不要为了装包成功而 `--no-verify`、`NODE_TLS_REJECT_UNAUTHORIZED=0`、`GOPRIVATE=*`、`GONOSUMDB=*`、`--insecure-registry`——这些会永久削弱后续所有安全校验。
- Docker daemon 镜像需要重启 daemon；容器内构建建议用 `--build-arg` 传镜像地址，避免改宿主 daemon。
- apt 换源前 `cp /etc/apt/sources.list{,.bak}`，换完 `apt-get update` 必须成功再继续。
- 镜像同步有延迟：镜像缺新版本时优先回退官方源，不要在镜像上找 `--pre` / 刚发布的版本死磕。
The environment inspection is limited to pip configuration and has a legitimate diagnostic purpose; there is no evidence of malicious harvesting or external transmission. Nevertheless, it prints potentially credential-bearing values verbatim, making this the same information-disclosure issue identified by the SQP-2 finding at lines 34–35.
# pip：看真实 index
pip -v install --dry-run requests 2>&1 | grep -i "Looking in indexes"
python -c "import os;print({k:v for k,v in os.environ.items() if k.startswith('PIP_')})"
# npm：优先级 project .npmrc > user .npmrc > global > env
npm config ls -l | grep -E "^registry|userconfig|globalconfig"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
pip -v install --dry-run requests 2>&1 | grep -i "Looking in indexes"
python -c "import os;print({k:v for k,v in os.environ.items() if k.startswith('PIP_')})"
# npm：优先级 project .npmrc > user .npmrc > global > env
npm config ls -l | grep -E "^registry|userconfig|globalconfig"
npm config get registry
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
pip -v install --dry-run requests 2>&1 | grep -i "Looking in indexes"
python -c "import os;print({k:v for k,v in os.environ.items() if k.startswith('PIP_')})"
# npm：优先级 project .npmrc > user .npmrc > global > env
npm config ls -l | grep -E "^registry|userconfig|globalconfig"
npm config get registry
The advice to copy host configuration into a Dockerfile or pass it through build arguments does not distinguish public registry settings from credential-bearing .npmrc content. Following it with an authenticated configuration can persist tokens in image layers or expose them through build metadata, caches, or logs; this is unsafe secret handling rather than evidence of credential theft.
- `.npmrc` 被 `--registry` 或 CI 的 `NPM_CONFIG_REGISTRY` 覆盖；或 pnpm 用了自己的 `pnpm config` 作用域。
- `~/.cargo/config`（旧名，无扩展）与 `config.toml` 同时存在 → 旧文件优先，改了新的没反应。
- Gradle 的 `init.gradle` 放在 `~/.gradle/init.d/` 才自动加载（放 `~/.gradle/init.gradle` 需要 `--init-script`）。
- 容器内构建不继承宿主的 daemon.json / `.npmrc`，要在 `Dockerfile` 里显式复制或传 `--build-arg`。
## 回滚清单（改过就要能退）
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
git config --global --unset-all url."https://ghfast.top/https://github.com/".insteadOf
sudo mv /etc/apt/sources.list.bak-YYYY-MM-DD /etc/apt/sources.list && sudo apt-get update
mv ~/.cargo/config.toml ~/.cargo/config.toml.bak
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
The helper sends the complete supplied URL through multiple third-party proxy operators before trying the origin, without restricting inputs to public, credential-free URLs. Private repository paths, embedded credentials, or signed query tokens could therefore be disclosed; HTTPS to the proxy does not hide the requested URL from that proxy.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
## 5. 硬约束清单
- `uv` / `pip` 混用同一 `PIP_INDEX_URL` 会互相干扰：跑 uv 时显式带 `--default-index`，别只依赖全局 env。
- 不要为了装包成功而 `--no-verify`、`NODE_TLS_REJECT_UNAUTHORIZED=0`、`GOPRIVATE=*`、`GONOSUMDB=*`、`--insecure-registry`——这些会永久削弱后续所有安全校验。
- Docker daemon 镜像需要重启 daemon；容器内构建建议用 `--build-arg` 传镜像地址，避免改宿主 daemon。
- apt 换源前 `cp /etc/apt/sources.list{,.bak}`，换完 `apt-get update` 必须成功再继续。
- 镜像同步有延迟：镜像缺新版本时优先回退官方源，不要在镜像上找 `--pre` / 刚发布的版本死磕。
This is a Playwright CLI invocation, not an MCP server, so the detector's classification is inaccurate. However, if Playwright is not installed locally, unversioned npx can fetch and execute a changing package version, creating a supply-chain exposure that the download-focused context does not eliminate.
This invokes Puppeteer's CLI rather than an MCP server, but the unpinned execution concern remains. If no local installation exists, npx can fetch and execute a newly resolved package version, and routing browser downloads through a mirror adds a separate artifact-trust dependency.
The go env -w commands persist user-wide proxy, checksum-database, and build settings despite the document's promise that unmarked examples are project-local. Subsequent unrelated builds can therefore use different dependency infrastructure, potentially exposing private module paths when privacy exclusions are absent and unexpectedly changing module-resolution behavior.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
/etc/apt/sources.list.d/*.sources 或 sources.list）[GLOBAL]sudo cp /etc/apt/sources.list{,.bak-$(date +%F)}
sudo sed -i 's|http://archive.ubuntu.com|https//mirrors.tuna.tsinghua.edu.cn|g; s|http://security.ubuntu.com|https//mirrors.tuna.tsinghua.edu.cn|g; s|http://deb.debian.org|https//mirrors.tuna.tsinghua.edu.cn|g' /etc/apt/sources.list
sudo apt-get update