Security audit

performance-mastery

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly legitimate performance-tuning guidance, but it includes administrator-level commands that can permanently change a host.

Install only if you are comfortable reviewing Linux tuning commands before use. Start with read-only diagnostics, avoid running persistent /etc, systemctl, udev, cron, fstab, or fio examples on production hosts without backups and a tested rollback, and pin or verify downloaded profiling tools.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

Location: references/cpu.md:95
Finding: Persistent CPU Governor Service Installed with System Privileges<![CDATA[ ## Vulnerability Details **File Location**: `references/cpu.md:95-108` **Vulnerability Type**: Privileged systemd service persistence **Risk Level**: Critical ### Complete Code Snippet ```bash # 持久化（systemd） cat > /etc/systemd/system/cpu-performance.service << 'EOF' [Unit] Description=Set CPU governor to performance After=multi-user.target [Service] Type=oneshot ExecStart=/bin/bash -c "for f in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor; do echo performance > $f; done" RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF systemctl enable --now cpu-performance.service ``` ### Technical Analysis The instructions create a root-owned systemd unit under `/etc/systemd/system` and enable it at boot. The service executes a shell command that writes to privileged CPU control interfaces for every CPU whenever the system starts. Although selecting the performance governor is related to performance tuning, permanently installing and enabling a system service is not necessary for diagnosis, profiling, or temporary benchmarking. It exceeds least privilege because the same evaluation can be performed using read-only inspection followed by a temporary governor change. The unit content is static in the current file, so there is no demonstrated hidden backdoor. Nevertheless, converting tuning advice into an automatically enabled privileged startup hook creates a dangerous execution boundary. If the unit content is altered before installation, the substituted command would run during startup with system privileges. ### Attack Path 1. A user or agent follows the CPU tuning instructions with root privileges. 2. The instructions overwrite `/etc/systemd/system/cpu-performance.service`. 3. `systemctl enable --now` starts the service and registers it for future boots. 4. The service writes to privileged sysfs CPU controls on every boot. 5. If an attacker can influence the generated unit content or command, the same startup hook can execute arbitr ...[truncated 558 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Default to read-only inspection of the current governor. - Apply governor changes temporarily and only after explicit user confirmation. - Do not automatically write to `/etc/systemd/system` or invoke `systemctl enable`. - If persistence is required, generate a proposed unit file for manual review rather than installing it. - Add an explicit rollback procedure: ```bash systemctl disable --now cpu-performance.service rm -f /etc/systemd/system/cpu-performance.service systemctl daemon-reload systemctl reset-failed ``` - Record and restore the original governor for each CPU rather than assuming a universal default. - Document power, thermal, cloud-host, and hardware compatibility risks before recommending the performance governor. ]]>

T06 · System Persistence

Error

Location: references/memory.md:144
Finding: Persistent Global Transparent Huge Page Modification<![CDATA[ ## Vulnerability Details **File Location**: `references/memory.md:144-158` **Vulnerability Type**: Privileged systemd service persistence **Risk Level**: High ### Complete Code Snippet ```bash # 持久化（写入启动脚本） cat > /etc/systemd/system/disable-thp.service << 'EOF' [Unit] Description=Disable Transparent Huge Pages After=network.target [Service] Type=oneshot ExecStart=/bin/sh -c "echo never > /sys/kernel/mm/transparent_hugepage/enabled" ExecStart=/bin/sh -c "echo never > /sys/kernel/mm/transparent_hugepage/defrag" RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF systemctl enable --now disable-thp.service ``` ### Technical Analysis This code installs and enables a boot-time system service that globally disables Transparent Huge Pages and THP defragmentation. The service writes to privileged kernel interfaces and remains registered after the Skill run ends. Disabling THP can be appropriate for selected databases or latency-sensitive applications, but making the setting global and persistent is broader than necessary for general performance analysis. The service does not scope the change to a particular workload, verify that the host actually exhibits THP-related latency, or preserve the original state. As with the CPU service, the current unit contains no hidden malicious payload. The risk arises from creating a persistent root execution mechanism and from applying a global kernel policy based on generic guidance. ### Attack Path 1. A user runs the documented commands with root privileges. 2. A system-level service file is written under `/etc/systemd/system`. 3. The service is immediately started and enabled for all future boots. 4. THP is disabled globally, affecting unrelated applications. 5. If the service body is modified through untrusted context or automation, arbitrary commands can execute as root at boot. ### Impact Assessment The setting affects all processes on the host and survives reboot. Workloads that benefit from THP m ...[truncated 365 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Require evidence of a THP-related bottleneck before suggesting any change. - Prefer temporary changes during a controlled benchmark. - Avoid enabling a system service automatically. - Record both original THP values before modification. - Provide complete rollback instructions: ```bash systemctl disable --now disable-thp.service rm -f /etc/systemd/system/disable-thp.service systemctl daemon-reload echo always > /sys/kernel/mm/transparent_hugepage/enabled echo always > /sys/kernel/mm/transparent_hugepage/defrag ``` - Restore the recorded original values rather than always using `always`. - Where possible, use application-specific `madvise` behavior instead of a host-wide setting. ]]>

T06 · System Persistence

Error

Location: references/disk_io.md:76
Finding: Persistent Disk Services, Timer, Cron Job, Udev Rules, and Startup Script<![CDATA[ ## Vulnerability Details **File Location**: `references/disk_io.md:76-84, 109-113, 188-191, 254-255, 314-318` **Vulnerability Type**: Multiple privileged persistence mechanisms **Risk Level**: Critical ### Complete Code Snippets ```bash # 持久化（udev 规则，推荐） cat > /etc/udev/rules.d/60-ioscheduler.rules << 'EOF' # NVMe SSD ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/scheduler}="none" # SATA SSD ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/scheduler}="mq-deadline" # HDD ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ATTR{queue/scheduler}="bfq" EOF udevadm control --reload-rules && udevadm trigger ``` ```bash # 持久化 cat > /etc/rc.local << 'EOF' #!/bin/bash blockdev --setra 4096 /dev/sda EOF chmod +x /etc/rc.local ``` ```bash # 持久化（udev 规则） cat >> /etc/udev/rules.d/60-ioscheduler.rules << 'EOF' ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/nr_requests}="256" ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/nr_requests}="1024" EOF ``` ```bash # 开启定时 TRIM（systemd timer） systemctl enable fstrim.timer systemctl start fstrim.timer ``` ```bash # 开启 SMART 后台监控（smartd） systemctl enable --now smartd # 配置 /etc/smartd.conf 发现问题时发邮件 # 添加定期检查到 crontab echo "0 3 * * 0 smartctl -a /dev/sda > /var/log/smart-sda-$(date +\%Y\%W).log" >> /etc/crontab ``` ### Technical Analysis The document introduces several independent cross-session mechanisms: - Global udev rules that modify I/O schedulers and queue depths. - An executable `/etc/rc.local` startup script. - An enabled systemd TRIM timer. - An enabled SMART monitoring daemon. - A recurring command appended to the system crontab. Some mechanisms, particularly `fstrim.timer` and `smartd`, have legitimate administration uses. However, automatically enabling them is not required for performance diagnosis. The udev and startup modifications also hard-code device classes and `/dev/sda`, which may not correspond to ...[truncated 1518 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Separate monitoring recommendations from persistent host configuration. - Do not automatically enable `fstrim.timer`, `smartd`, or cron entries. - Detect the actual target device and require explicit confirmation before making any device-specific change. - Never overwrite `/etc/rc.local`; avoid using it as a persistence mechanism. - Generate proposed udev, systemd, or cron configuration for administrator review. - Check whether equivalent services or jobs already exist before adding anything. - Add log rotation and retention if recurring SMART reports are explicitly requested. - Provide complete rollback steps: ```bash systemctl disable --now fstrim.timer systemctl disable --now smartd rm -f /etc/udev/rules.d/60-ioscheduler.rules udevadm control --reload-rules sed -i '\|smartctl -a /dev/sda|d' /etc/crontab ``` - Preserve and restore any pre-existing `/etc/rc.local` content from a verified backup. - Prefer one-time `fstrim` and `smartctl` commands during diagnosis. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bench-compare.sh:43
Finding: Arbitrary Shell Command Execution in Benchmark Utility<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bench-compare.sh:43-46, 69-81, 84-96` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Complete Code Snippet ```bash while [[ $# -gt 0 ]]; do case "$1" in --baseline) BASELINE_CMD="$2"; MODE="compare"; shift 2 ;; --candidate) CANDIDATE_CMD="$2"; shift 2 ;; --command) BASELINE_CMD="$2"; MODE="single"; shift 2 ;; --go-bench) GO_PKG="$2"; MODE="go"; shift 2 ;; --runs) RUNS="$2"; shift 2 ;; --non-interactive) NON_INTERACTIVE=true; shift ;; --help|-h) usage ;; *) echo "未知参数: $1"; usage ;; esac done ``` ```bash confirm_commands() { echo "即将执行的命令:" >&2 for arg in "$@"; do echo " $arg" >&2 done echo "" >&2 # 非交互模式（管道/重定向）跳过确认 if [ "$NON_INTERACTIVE" = true ]; then echo "(非交互模式，跳过确认)" >&2 elif [ -t 0 ]; then echo "按 Enter 继续，Ctrl+C 取消..." >&2 read -r fi } ``` ```bash run_timed() { local cmd="$1" local n="$2" local label="$3" local times=() echo "运行 $label ($n 次)..." >&2 for i in $(seq 1 "$n"); do start=$(date +%s%N) bash -c "$cmd" > /dev/null 2>&1 end=$(date +%s%N) elapsed=$(( (end - start) / 1000000 )) # ms times+=("$elapsed") ``` ### Technical Analysis The script accepts a complete command string from command-line arguments and evaluates it through `bash -c`. Shell metacharacters, substitutions, pipelines, redirections, and command separators are therefore interpreted as executable syntax. This interface may be intentional for flexible benchmarking, but it is unsafe when benchmark commands originate from untrusted task text, generated agent output, CI variables, issue descriptions, or configuration files. The confirmation control does not establish trust: it is skipped when standard input is non-interactive and can be explicitly bypassed with `--no ...[truncated 1208 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Replace command strings with argument arrays and execute them directly without `bash -c`. - Use an interface such as: ```bash bench-compare.sh --runs 10 -- command arg1 arg2 ``` - Preserve each argument exactly and invoke the command with `"${command_args[@]}"`. - If shell syntax is an essential feature, clearly designate it as unsafe and require explicit interactive approval regardless of terminal state. - Do not allow `--non-interactive` for arbitrary command strings unless commands come from a trusted, reviewed manifest. - Reject newline characters and dangerous shell metacharacters when compatibility permits. - Validate numeric and path arguments and document that users must never interpolate untrusted content into benchmark commands. - Run benchmarks inside a restricted container or sandbox with no secrets, limited network access, a read-only filesystem, and resource limits. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: references/java_performance.md:77
Finding: Unpinned Remote Profiling Tools and Dependencies Are Downloaded for Local Execution<![CDATA[ ## Vulnerability Details **File Location**: `references/java_performance.md:77-88, 166-167`; additional instances in `SKILL.md:336-337`, `references/nodejs_performance.md:28-37`, and `scripts/run-evals.py:29` **Vulnerability Type**: Mutable remote payload retrieval and insecure dependency installation **Risk Level**: Medium ### Complete Code Snippets ```bash # 下载 wget https://github.com/async-profiler/async-profiler/releases/latest/download/async-profiler-3.0-linux-x64.tar.gz # CPU 火焰图（30秒采样） ./asprof -d 30 -f flamegraph.html <PID> # 内存分配火焰图 ./asprof -d 30 -e alloc -f alloc-flame.html <PID> # 锁竞争分析 ./asprof -d 30 -e lock -f lock-flame.html <PID> ``` ```bash # 下载启动 curl -O https://arthas.aliyun.com/arthas-boot.jar java -jar arthas-boot.jar ``` ```bash npx clinic doctor -- node app.js npx clinic flame -- node app.js ``` ```text pip install pyyaml openai ``` ### Technical Analysis The Skill recommends downloading executable profiling tools and installing packages without consistently pinning immutable versions or verifying signatures or checksums. The async-profiler URL uses the apparent official project organization on GitHub rather than a personal paste site. However, the use of a `latest` release route makes the retrieved artifact mutable after the Skill has been reviewed. The Arthas JAR is downloaded and directly executed without integrity validation. `npx` can retrieve and run packages dynamically, while unversioned `pip install` commands permit dependency versions to change over time. This creates a time-of-check/time-of-use supply-chain gap: the code that eventually runs is not contained in the audited project and can change independently. ### Attack Path 1. A user follows the profiling setup instructions. 2. A mutable release, package registry, hosting account, DNS path, or upstream build is compromised or changes unexpectedly. 3. The user downloads or installs an altered artifact. 4. The artifact is executed through `java -jar`, ` ...[truncated 778 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Pin exact tool and package versions instead of using `latest` or unversioned installs. - Publish expected SHA-256 hashes and verify artifacts before extraction or execution. - Prefer signed release artifacts and verify signatures against documented maintainer keys. - Use package lockfiles and hash-locked dependency files, such as: ```bash pip install --require-hashes -r requirements.txt ``` - Use explicit `npx` package versions and disable implicit substitution where supported. - Download artifacts into a controlled directory with safe permissions. - Avoid executing downloaded tools as root unless their documented functionality strictly requires it. - Record the upstream project, release version, expected archive layout, checksum, and verification procedure. - Prefer trusted operating-system packages when they provide a suitably maintained and reproducible version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (162)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a performance-analysis advisor, but it also exposes automated evaluation behavior involving local YAML loading and external OpenAI-compatible API calls. This mismatch weakens user trust and reviewability because operators may grant the skill access expecting diagnostics, while hidden or under-declared behaviors can transmit data externally or perform unrelated automation.

Ae1

High

Category: analysis-evasion
Content: 1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: │ └── 内核态高 → perf top / bpftrace → references/ebpf_bpftrace.md
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: │ └── 内核态高 → perf top / bpftrace → references/ebpf_bpftrace.md
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: │ └── 内核态高 → perf top / bpftrace → references/ebpf_bpftrace.md
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # 回滚 sysctl -w 参数名=原始值 # 临时回滚 rm /etc/sysctl.d/99-perf-tuning.conf && sysctl --system # 持久化回滚 ``` ---
Confidence: 86% confidence
Finding: The rollback example `rm /etc/sysctl.d/99-perf-tuning.conf && sysctl --system` is a destructive file operation affecting persistent system configuration. In an agent or copy-paste workflow, a generic delete command can remove legitimate settings wholesale, causing service regressions or security/performance drift beyond the single parameter being rolled back.

Privileged Container / Container Escape

High

Category: Privilege Escalation
Content: | 平台 | 注意事项 | |------|---------| | **容器/K8s** | 需 `--privileged` 或 `SYS_ADMIN` 才能运行 perf/eBPF；cgroup 限制需宿主机/平台侧修改 | | **Windows** | `perf` 不可用，用 ETW/xperf；Python multiprocessing 需 `if __name__ == '__main__'` | | **macOS** | 无 `perf`/eBPF，用 Instruments.app 或 `dtrace` | | **WSL2** | perf 可能需要自行编译匹配内核版本 |
Confidence: 82% confidence
Finding: Advising `--privileged` or `SYS_ADMIN` in container contexts materially weakens container isolation and can enable host-level compromise if applied broadly. Even though framed as a platform note, recommending such powerful modes without emphasizing safer alternatives normalizes dangerous deployment patterns in exactly the environments where agents may be trusted to guide operations.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Content: BSan | 未定义行为 | < 1.5x | GCC/Clang | | MSan | 未初始化内存读 | 3x | 仅 Clang | > ⚠️ ASan 与 TSan 不能同时使用；ASan 与 MSan 不能同时使用。 ### 1.4 gperftools（Google Performance Tools） ```bash # 安装 apt install google-perftools libgoogle-perftools-dev # Debian/Ubuntu yum install gperftools gperftools-devel # CentOS/RHEL # CPU Profiler LD_PRELOAD=/usr/lib/libprofiler.so CPUPROFILE=cpu.prof ./myapp google-pprof --text ./myapp cpu.prof # 文本报告 google-pprof --svg ./myapp cpu.prof > cpu.svg # SVG 火焰图 google-pprof --web ./myapp cpu.prof # 浏览器查看 # Heap Profiler LD_PRELOAD=/usr/lib/libtcmalloc.so HEAPPROFILE=heap.prof ./myapp google-pprof --text ./myapp heap.prof.0001.heap # tcmalloc 替换 glibc malloc（性能提升显著） LD_PRELOAD=/usr/lib/libtcmalloc_minimal.so ./myapp ``` ### 1.5 Intel VTune / AMD uProf ```bash # Intel VTune（性能分析黄金标准） vtune -collect hotspots
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Context Leakage

High

Category: Data Exfiltration
Content: # Intel VTune（性能分析黄金标准） vtune -collect hotspots -result-dir=r001hs ./myapp vtune -collect memory-access -result-dir=r001mem ./myapp vtune -collect threading -result-dir=r001thr ./myapp # AMD uProf AMDuProfCLI collect --config tbp -o /tmp/prof ./myapp
Confidence: 75% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Content: f("/sys/fs/cgroup/cpu.max"); # if (f.is_open()) { # std::string quota_s, period_s; # f >> quota_s >> period_s; # if (quota_s != "max") return std::max(1, std::stoi(quota_s) / std::stoi(period_s)); # } # return std::thread::hardware_concurrency(); # } # 3. 内存分配器选择 # glibc malloc 在容器中可能导致内存碎片 # 推荐：jemalloc 或 tcmalloc LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so ./app # ⚠️ 常见坑： # 1. std::thread::hardware_concurrency() 返回宿主机核数 # 2. /proc/cpuinfo 显示宿主机所有 CPU # 3. glibc malloc 的 ARENA 数量默认 = 8 × CPU核数，在容器中会过多 # 设置 MALLOC_ARENA_MAX=4 限制 arena 数量 MALLOC_ARENA_MAX=4 ./app ``` --- ## Service Mesh 性能影响与优化 ### Sidecar 代理的性能开销 Service Mesh（如 Istio/Linkerd）通过 sidecar 代理拦截所有网络流量，会引入额外延迟和资源消耗： | 指标 | 无 Service Mesh | Istio (Envoy) |
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Missing User Warnings

High

Confidence: 99% confidence
Finding: The fio benchmark examples write a 4G test file to /data/fio_test using direct I/O, but the section does not clearly warn that this can consume space, distort production workloads, trigger latency spikes, or damage user data if the path is mischosen. In a performance-tuning skill, benchmark commands are likely to be executed verbatim, increasing the chance of unsafe use on live data volumes.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: --runtime=30 --time_based --group_reporting # 清理测试文件 rm /data/fio_test # 性能参考（常见磁盘类型）： # ┌─────────────┬──────────────┬──────────────┬────────────┐
Confidence: 94% confidence
Finding: The cleanup command deletes a fixed path under /data without requiring validation that the file was created by the benchmark or that the path is safe. In operational documentation, unconditional deletion commands are dangerous because users may adapt or rerun them in environments where the path points to important data or where shell expansion/path mistakes can cause loss.

Privileged Container / Container Escape

High

Category: Privilege Escalation
Content: ### 注意事项 - 需要内核 >= 4.9（bpftrace 推荐 >= 5.0） - 容器中需要 `--privileged` 或 `CAP_SYS_ADMIN` + `CAP_BPF` - macOS 不支持 eBPF（用 dtrace 替代） - WSL2 支持但可能需要自编译内核 - 生产环境建议使用 tracepoint 而非 kprobe（更稳定）
Confidence: 88% confidence
Finding: The note states that containers may need `--privileged` or broad capabilities such as `CAP_SYS_ADMIN` to use eBPF. In real deployments, recommending privileged containers materially increases attack surface and can enable container breakout, host compromise, or abuse of kernel instrumentation if the containerized workload is ever compromised. The performance-engineering context makes this more dangerous because operators may copy the guidance directly into production diagnostics or Kubernetes manifests.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # ... 逐一回滚 # 方案2：删除配置文件并重新加载 rm /etc/sysctl.d/99-performance-mastery.conf sysctl --system # 注意：已通过 sysctl -w 临时设置的值不会自动还原，需手动回滚 ```
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # 删除 Swap swapoff /swapfile rm /swapfile sed -i '/swapfile/d' /etc/fstab ```
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and demonstrates shell, file read/write, and environment-dependent operations but does not declare any explicit tool scope or permissions boundary. In an agent environment, this can lead to over-broad execution authority, making it easier for the skill to run impactful system commands without clear operator consent or sandbox constraints.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The manifest description presents the skill role and activation context entirely in Chinese, and the document consistently instructs behavior in Chinese without offering a language choice. This creates a locale/language constraint that is not documented as optional or region-specific, which can violate language preference policy.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: Using `npx clinic` without pinning a version makes execution dependent on whatever package version is resolved at runtime. This creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code on the host when the skill follows the documented command.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: A second unpinned `npx clinic` invocation repeats the same supply-chain exposure. Because `npx` may fetch and execute remote package code dynamically, the host inherits risk from upstream tampering or accidental malicious package substitution.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: This section includes commands that persist kernel tuning changes and modify `/etc/sysctl.d`, with rollback examples that can delete config files, but the warning is not colocated with the specific commands. In agent-assisted workflows, nearby missing safeguards increase the chance that users copy or authorize impactful system changes without understanding persistence, service impact, or recovery requirements.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: This YAML evaluation file defines all user-facing test names, prompts, and expected outputs in Chinese, which imposes a specific language context across the skill evaluation. There is no indication that users may choose another language or that the locale restriction is intentionally documented as a region-specific constraint.

Static analysis

No suspicious patterns detected.