Security audit

Mihomo Subscription Route Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned but should be reviewed because it can directly change live routing infrastructure and local Mihomo runtime state without an explicit confirmation gate.

Install only if you are an authorized operator for the named Mihomo repo, Cloudflare Worker, published subscription domain, and local runtime. Before using it, add or enforce a human confirmation step for deploy, /sync, /etc config updates, service restart, commit, and push, and review diffs before publication.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The FAQ explicitly states that some requests may modify /etc/mihomo/config.yaml and restart the mihomo service, but it does not pair that capability with a clear user-consent or safety warning. In an agent skill that acts on natural-language requests, this increases the risk of unintentional live system changes, service disruption, or privilege-sensitive configuration edits if the agent proceeds without an explicit confirmation step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly states that the skill will turn a natural-language request into repository changes, worker redeployment, and a verified live subscription update, but it provides no warning that using the skill can modify production-like infrastructure and published network-routing behavior. In an agent-skill context, this increases the chance of unintended or insufficiently reviewed changes being applied directly to a live distribution endpoint from ambiguous user input.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The listed outputs include regenerated worker assets, redeployed worker, refreshed published subscription objects, and verification against the live endpoint, yet the README omits any caution that these actions alter externally served state. Because the skill targets a live subscription domain used for routing rules, missing warnings and guardrails make accidental service-impacting publication more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to deploy a worker, trigger a live /sync, verify the public artifact, and optionally commit/push changes, but it does not require an explicit confirmation gate before taking those production-affecting actions. In an agentic environment, a natural-language routing request could therefore cause unintended changes to live infrastructure and source control, increasing the risk of accidental production modification, policy violations, or abuse if a prompt is malicious or ambiguous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow explicitly includes deployment, subscription synchronization, live verification, and optional restart/push steps, but it does not require any user confirmation, safety prompt, or warning before performing operations that can change published network-routing behavior and affect live systems. In this skill context, those actions are especially sensitive because they modify a production subscription endpoint consumed by Mihomo clients, so unintended or over-broad natural-language requests could propagate quickly to downstream users.
Content: No source excerpt is available for this finding.