Security audit
Security checks across malware telemetry and agentic risk
This installer is mostly aligned with deploying JiuwenSwarm, but it silently changes the environment, persists cloud credentials, runs downloaded code without integrity checks, and can kill or replace local processes and commands.
Install only in a disposable Huawei Cloud development container where you are comfortable with package installation, global command changes, a long-running exposed service, and local plaintext persistence of the API key in ~/.jiuwenswarm/config/.env. Avoid running the verification instructions that print or source the .env file in shared logs or terminals, and prefer a version that pins and verifies the downloaded runtime before execution.
tmp_dir = tempfile.mkdtemp()
try:
write_progress("[1/5] Cloning via git LFS...")
subprocess.run(
["git", "clone", "--depth", "1", "-b", "main",
LFS_REPO_URL, tmp_dir],
check=True, timeout=DOWNLOAD_TIMEOUT"Check mirror archive structure")
if not os.path.isfile(ENV_FILE):
os.makedirs(os.path.dirname(ENV_FILE), exist_ok=True)
subprocess.run(RUNTIME_INIT, capture_output=True)
# Config .env
config = get_keyring_config()for cmd_name, cmd_path in commands.items():
link_path = os.path.join(bin_dir, cmd_name)
if os.path.islink(link_path) or os.path.isfile(link_path):
subprocess.run(f"{sudo} rm -f {link_path}", shell=True, capture_output=True)
if os.path.isfile(cmd_path):
subprocess.run(f"{sudo} ln -sf {cmd_path} {link_path}", shell=True, capture_output=True)
subprocess.run(f"{sudo} chmod +x {link_path}", shell=True, capture_output=True)if os.path.islink(link_path) or os.path.isfile(link_path):
subprocess.run(f"{sudo} rm -f {link_path}", shell=True, capture_output=True)
if os.path.isfile(cmd_path):
subprocess.run(f"{sudo} ln -sf {cmd_path} {link_path}", shell=True, capture_output=True)
subprocess.run(f"{sudo} chmod +x {link_path}", shell=True, capture_output=True)
# Init workspacesubprocess.run(f"{sudo} rm -f {link_path}", shell=True, capture_output=True)
if os.path.isfile(cmd_path):
subprocess.run(f"{sudo} ln -sf {cmd_path} {link_path}", shell=True, capture_output=True)
subprocess.run(f"{sudo} chmod +x {link_path}", shell=True, capture_output=True)
# Init workspace
if not os.path.isfile(RUNTIME_INIT):print(f"[4/5] 🛑 Stopping existing instance (ports found: {existing_ports})...", flush=True)
try:
# Kill processes occupying jiuwenswarm ports
result = subprocess.run(
"ss -tlnp 2>/dev/null | grep -E ':(517[0-9]|1809[0-9]|1900[0-9]|1901[0-9])' | grep -oP 'pid=\\K\\d+' | sort -u",
shell=True, capture_output=True, text=True, timeout=5
)def is_port_listening(port):
result = subprocess.run(
f"ss -tlnp | grep ':{port}'",
shell=True, capture_output=True
)sudo = "sudo" if os.getuid() != 0 else ""
for pm in ["dnf", "yum", "apt-get"]:
if subprocess.run(f"command -v {pm}", shell=True, capture_output=True).returncode == 0:
subprocess.run(f"{sudo} {pm} install -y keyutils", shell=True, capture_output=True)
returnactions = result["objects"][0].get("actions", {})
download_url = actions.get("download", {}).get("href", "")
if download_url:
resp = requests.get(download_url, stream=True, timeout=DOWNLOAD_TIMEOUT)
resp.raise_for_status()
total = int(resp.headers.get("content-length", 0))
total_mb = total // 1024 // 1024VirusTotal findings are pending for this skill version.
No suspicious patterns detected.