Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Clash Verge controller guide, but it exposes high-impact proxy administration with unsafe network and credential handling defaults that users should review before installing.
Install only if you understand that this gives an agent guidance and sample code for administering your Clash Verge/mihomo controller. Keep the controller bound to 127.0.0.1 where possible, avoid wildcard CORS, do not expose the API over plaintext HTTP, avoid passing secrets on the command line, and require explicit confirmation before restart, config changes, cache flushes, rule changes, upgrades, or closing connections.
scripts/clash_api_client.py:15Bearer Credential Transmitted Over Plaintext HTTP
scripts/clash_api_client.py:126Controller Secret Exposed Through Command-Line Arguments
SKILL.md:34Overly Permissive CORS and Private-Network Access Configuration
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
curl http://127.0.0.1:9090/group/Proxy
### DELETE /group/{group_name}
清除自动策略组的 fixed 选择
The documented ability to terminate all active connections is a powerful disruptive action that can immediately cut off user traffic or ongoing tasks. In an agent skill, exposing this operation without strong warnings, confirmation requirements, or guardrails makes accidental or abusive denial-of-service more likely.
curl "http://127.0.0.1:9090/connections?interval=1000"
### DELETE /connections
关闭所有连接
The endpoint allows arbitrary connection termination by ID, which can be used to disrupt targeted sessions and interfere with user activity. In the context of an automation skill, this becomes more dangerous because an agent may act on IDs programmatically without adequate validation or user awareness.
-H "Authorization: Bearer ${secret}"
### DELETE /connections/{id}
关闭指定连接
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill documents a destructive endpoint to close connections without clearly warning that it can immediately terminate active traffic, disrupt applications, and break user sessions. In a controller skill for network middleware, that omission increases the chance of accidental denial of service caused by an agent or user invoking the endpoint without understanding the impact.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
proxies = requests.get(f"{API}/proxies", headers=headers).json()
# 切换节点
requests.put(
f"{API}/proxies/Proxy",
headers=headers,
json={"name": "香港节点-01"}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -H 'Authorization: Bearer ${secret}' \
http://127.0.0.1:9090/configs?force=true \
-d '{"path": "", "payload": ""}' -X PUT
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
返回： 内存单位为 kb
curl http://127.0.0.1:9090/memory
The cache flush and similar irreversible maintenance actions are documented as routine calls without warning that they may disrupt DNS/FakeIP behavior or active sessions. In a skill consumed by agents, omission of safety guidance can lead to accidental destructive execution.
The document exposes high-impact management operations such as reloading configs, restarting, upgrading, and modifying runtime state, but it does not clearly warn that these actions can disrupt service, break connectivity, or apply destructive changes. In an agent skill context, this increases the chance that an automated system or user invokes these endpoints without understanding operational consequences.
The code defines a method that deletes all active connections via the API, which is a disruptive and potentially irreversible action. Although the method has an internal docstring, there is no confirmation prompt, visible user-facing log, or surrounding warning in this file to disclose the impact before use.
The connections API examples and response schema expose sensitive network metadata including source IP, destination IP, ports, and hostnames, but the documentation does not mention privacy or handling considerations. In an agent setting, this raises risk of overcollection, logging, or unintended disclosure of user network activity.
The natural-language descriptions and CLI help text in this file are presented only in Chinese, with no indication that users may choose another language or locale. Per the policy, forcing a single language without opt-in can be a locale-policy violation unless clearly justified.