fluxmount

• Outcome: Review
• Latest audit: Aug 12, 2026 · 2:42 PM UTC
• Version: 0.1.0

Overview

FluxMount has a real NTFS-write purpose, but it installs privileged disk-mounting automation with passwordless sudo and startup/hot-plug persistence by default.

Install only on a trusted Mac after backing up important external-drive data. Review the scripts first, prefer dry-run, verify macFUSE from the official source with a pinned checksum or signer, and consider disabling or editing the default passwordless sudo and LaunchAgent automation unless you explicitly want unattended remounting on boot and device insertion.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents substantial shell-based system modification behavior but does not declare corresponding permissions. This creates a transparency and consent gap: an agent or user may invoke a skill that performs installation, privilege escalation setup, and persistence-related actions without an explicit permission model. In this context, the undocumented shell capability is more dangerous because the described workflow includes package installation, launch agent registration, and writable remounting of external disks.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The document states that the commands only affect the user's account and do not change machine configuration, but the same file includes actions that publish repository contents to third-party services and modify remote GitHub metadata. This is a misleading safety claim that can cause users to underestimate data exposure and account-level changes, especially when authenticated APIs are involved.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation asserts that disk data will not be modified, yet it also describes writable remounting and write-permission verification against the NTFS volume. Any write test or user follow-on usage after a read-write remount can alter filesystem state, so the safety claim is misleading and may cause users to underestimate risk. In a storage-mounting skill, inaccurate claims about non-modification are especially sensitive because users may trust it with important external drives.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The instructions encourage uploading the whole repository or a packaged skill to external registries without a clear warning to inspect the contents first. In a skill ecosystem, repository archives can easily contain secrets, private notes, local paths, or platform-specific files that the author did not intend to disclose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Qoder example uses a bearer token and uploads a zip archive, but it does not warn about token handling, shell history exposure, or validating the archive contents before transmission. This creates a realistic risk of credential leakage or accidental publication of sensitive files, made more relevant because the skill is specifically about packaging and distributing local automation artifacts.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The GitHub API example uses a personal access token but gives no caution about secret handling or scope minimization. Even though this is a common administrative workflow, publishing token-based examples without warnings can lead users to over-scope tokens, expose them in shell history, or run them in shared environments.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The onboarding instructs the user to authenticate with GitHub and later use a bearer token for Qoder publication, but does not clearly warn against using shared terminals, exposing shell history, or leaking tokens in logs and screenshots. In agent or sandboxed environments, these steps could cause accidental credential disclosure or misuse of personal publishing accounts.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The phrase indicating users can say something like 'help me install a skill that can read/write NTFS disks' is broad enough to overlap with ordinary conversation, increasing the chance of unintended skill discovery or installation. In agent ecosystems that auto-match on natural-language descriptions, ambiguous triggers can cause unreviewed activation of a skill that performs sensitive local system operations.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The guide says WorkBuddy scans SKILL.md and triggers based on the description, but it does not define scope, precedence, or conditions under which the skill should not activate. Because this skill ultimately affects disk mounting behavior, ambiguous matching increases the risk of accidental invocation in response to normal user requests about external drives.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The file encourages invocation via broad natural-language phrases such as asking how to write to NTFS on Mac, which can overlap with ordinary user conversation rather than an explicit consented action. In the context of a local system skill that can run bash and modify mount behavior on a user's machine, overly loose triggering raises the risk of accidental activation and unintended execution of privileged or system-altering steps.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The invocation guidance encourages broad natural-language matching such as 'install a skill that writes NTFS disks,' which can cause the agent to auto-select and run this skill in situations where the user did not clearly consent to system-level disk modification steps. In the context of a skill that may install drivers, alter mount behavior, or change startup automation, over-broad triggering increases the risk of unintended privileged actions.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The documentation states that WorkBuddy decides whether to invoke the skill based primarily on the description field, but it does not define boundaries for when the skill must not activate. Because this skill deals with filesystem mounting and likely system configuration changes, ambiguous scope can lead to inappropriate activation and unsafe guidance in unrelated storage or permissions scenarios.

External Transmission

Medium

• Category: Data Exfiltration

Content

dmg=""
  for u in "${MACFUSE_URLS[@]}"; do
    echo "  ⬇️  尝试: $u"
    if curl -L --connect-timeout 20 --max-time 180 -o "/tmp/$MACFUSE_DMG" "$u" 2>/dev/null && [ -s "/tmp/$MACFUSE_DMG" ]; then
      dmg="/tmp/$MACFUSE_DMG"; echo "  ✅ 下载成功"; break
    fi
  done

• Confidence: 92% confidence
• Finding: curl -L --connect-timeout 20 --max-time 180 -o "/tmp/$MACFUSE_DMG" "$u" 2>/dev/null && [ -s "/tmp/$MACFUSE_DMG" ]; then dmg="/tmp/$MACFUSE_DMG"; echo " ✅ 下载成功"; break fi done if [ -z "$

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install.sh 会自动：检测系统 → 装 macFUSE（国内镜像兜底 GitHub 被墙）→ 装 ntfs-3g（用 `brew tap gromgit/homebrew-fuse` + `brew install ntfs-3g-mac`，规避 Homebrew Tier-3 无包）→ 部署脚本到 /usr/local/bin → 配置免密 sudo → 注册开机 + 热插拔自动挂载（LaunchAgent，现代 bootstrap 方式）→ 立即挂载一次。**安装前会自动备份被覆盖的文件到 ~/.fluxmount-backup，可随时回退。**

> 注意：沙箱/远程环境通常禁止 sudo 与 launchctl 写操作，安装与批准系统扩展必须在用户**真实终端**完成，本 skill 负责生成脚本与指引，不会在你的电脑上做不可控的改动。

### 3. 用户只需一次的人工步骤（每个 Mac 一次）

• Confidence: 96% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 本 skill 相对竞品的特色（作者沉淀）

- **国内网络专治**：macFUSE 下载走 kgithub / ghproxy 多个国内镜像兜底；ntfs-3g 用 gromgit tap 的 `ntfs-3g-mac`（有预编译包），避开 Homebrew 对旧 macOS 的 Tier-3 无包与 GitHub 被墙。
- **傻瓜式一次到位**：单命令安装 + doctor 自检 + dry-run 预览，把"系统扩展批准 / 免密 sudo / 代理注册"三件最容易翻车的事都自动化或半自动化。
- **防复发**：开机（RunAtLoad）+ 热插拔（StartOnMount）双触发；幂等（已可读写则跳过，不干扰正在用的盘）；指数退避重试 + 写权限校验。
- **多盘支持**：遍历所有只读 NTFS 分区逐个重挂载，挂回原卷名（Finder 名字不变）。
- **安全可控**：免密 sudo 仅放行 `mount-ntfs-rw` 一条命令；安装前自动备份被覆盖文件，uninstall 可完整还原；**只重挂载、绝不删除或改动盘内数据**。

• Confidence: 94% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **傻瓜式一次到位**：单命令安装 + doctor 自检 + dry-run 预览，把"系统扩展批准 / 免密 sudo / 代理注册"三件最容易翻车的事都自动化或半自动化。
- **防复发**：开机（RunAtLoad）+ 热插拔（StartOnMount）双触发；幂等（已可读写则跳过，不干扰正在用的盘）；指数退避重试 + 写权限校验。
- **多盘支持**：遍历所有只读 NTFS 分区逐个重挂载，挂回原卷名（Finder 名字不变）。
- **安全可控**：免密 sudo 仅放行 `mount-ntfs-rw` 一条命令；安装前自动备份被覆盖文件，uninstall 可完整还原；**只重挂载、绝不删除或改动盘内数据**。

> 踩坑经验（已固化到 troubleshooting.md）：GitHub 被墙用国内镜像；Homebrew `brew install ntfs-3g` 在 2026 年 macOS 15 Intel 上因 Tier-3 无 bottle 失败，应改 `ntfs-3g-mac`；新版 Xcode/Clang 把隐式函数声明当硬错误导致源码编译失败；`launchctl load` 在 macOS 15 已弃用，改用 `launchctl bootstrap gui/$(id -u)`；Bash 工具沙箱会禁 sudo/launchctl 写操作，验证需用户本机执行。

• Confidence: 93% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

exit 1
  fi
  echo "  🔐 即将安装 macFUSE 系统扩展，请输入管理员密码:"
  sudo installer -pkg "$pkg" -target / >/dev/null 2>&1 && echo "  ✅ macFUSE 安装完成" || echo "  ❌ macFUSE 安装失败"
  hdiutil detach "$mnt" >/dev/null 2>&1 || true
else
  echo "✅ [1/4] macFUSE 已安装，跳过。"

• Confidence: 82% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

backup_if_exists "$AUTO_SH"
backup_if_exists "$SUDOERS"
backup_if_exists "$AGENT_PLIST"
sudo cp "$(dirname "$0")/mount-ntfs-rw" "$MOUNT_SH"
sudo cp "$(dirname "$0")/ntfs-automount" "$AUTO_SH"
sudo chmod +x "$MOUNT_SH" "$AUTO_SH"
echo "  ✅ 脚本已装到 $BIN"

• Confidence: 87% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

backup_if_exists "$SUDOERS"
backup_if_exists "$AGENT_PLIST"
sudo cp "$(dirname "$0")/mount-ntfs-rw" "$MOUNT_SH"
sudo cp "$(dirname "$0")/ntfs-automount" "$AUTO_SH"
sudo chmod +x "$MOUNT_SH" "$AUTO_SH"
echo "  ✅ 脚本已装到 $BIN"

• Confidence: 87% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo chmod +x "$MOUNT_SH" "$AUTO_SH"
echo "  ✅ 脚本已装到 $BIN"

# 免密 sudo (仅放行 mount-ntfs-rw)
echo "$USER ALL=(root) NOPASSWD: $MOUNT_SH" | sudo tee "$SUDOERS" >/dev/null
sudo chmod 440 "$SUDOERS"
echo "  ✅ 已配置免密 sudo (自动挂载不会弹密码框)"

• Confidence: 98% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 4) 立即挂载
echo ""
echo "📦 [4/4] 立即以可读写挂载当前 NTFS 盘..."
sudo "$MOUNT_SH" || true

echo ""
echo "=========================================================="

• Confidence: 83% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "⚡ 以可读写挂载: $dev -> $target"
  ok=0
  for attempt in 1 2 3; do
    if sudo "$NTFS_3G" "$dev" "$target" -o rw,auto_xattr,auto_cache,local,allow_other 2>/dev/null; then
      # 写权限校验
      probe="$target/.fluxmount_rw_test_$(date +%s)"
      if touch "$probe" 2>/dev/null; then

• Confidence: 79% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

#  作者: 张昌宇 (Changyu Zhang)
#  用途: 被 LaunchAgent 在【开机】和【热插拔】时调用，自动以可读写挂载 NTFS 盘。
#        日志写到 /tmp/fluxmount.log 便于排查。
#  注意: 本脚本以当前用户身份运行，内部 mount-ntfs-rw 用免密 sudo 提权
#        (已在 /etc/sudoers.d/fluxmount 配置 NOPASSWD)，无需人工输密码。
# ============================================================================
LOG="/tmp/fluxmount.log"

• Confidence: 88% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

local f="$1"
  local bak="$BACKUP_DIR/$(echo "$f" | tr '/' '_')"
  if [ -e "$bak" ]; then
    sudo cp -a "$bak" "$f" 2>/dev/null && echo "  ♻️  已还原安装前文件: $f" || echo "  ⚠️  还原失败: $f"
  else
    sudo rm -f "$f" 2>/dev/null && echo "  🗑️  已移除: $f" || echo "  ⚠️  移除失败(可能需手动): $f"
  fi

• Confidence: 76% confidence
• Finding: sudo

Session Persistence

Medium

• Category: Rogue Agent

Content

- **多盘支持**：遍历所有只读 NTFS 分区逐个重挂载，挂回原卷名（Finder 名字不变）。
- **安全可控**：免密 sudo 仅放行 `mount-ntfs-rw` 一条命令；安装前自动备份被覆盖文件，uninstall 可完整还原；**只重挂载、绝不删除或改动盘内数据**。

> 踩坑经验（已固化到 troubleshooting.md）：GitHub 被墙用国内镜像；Homebrew `brew install ntfs-3g` 在 2026 年 macOS 15 Intel 上因 Tier-3 无 bottle 失败，应改 `ntfs-3g-mac`；新版 Xcode/Clang 把隐式函数声明当硬错误导致源码编译失败；`launchctl load` 在 macOS 15 已弃用，改用 `launchctl bootstrap gui/$(id -u)`；Bash 工具沙箱会禁 sudo/launchctl 写操作，验证需用户本机执行。

• Confidence: 91% confidence
• Finding: launchctl load

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.