Security audit

performance-mastery

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly legitimate performance-tuning guidance, but it includes administrator-level commands that can permanently change a host.

Install only if you are comfortable reviewing Linux tuning commands before use. Start with read-only diagnostics, avoid running persistent /etc, systemctl, udev, cron, fstab, or fio examples on production hosts without backups and a tested rollback, and pin or verify downloaded profiling tools.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

Location: references/cpu.md:95
Finding: Persistent CPU Governor Service Installed with System Privileges
Content: View full analysis
/etc/systemd/system/cpu-performance.service << 'EOF' [Unit] Description=Set CPU governor to performance After=multi-user.target [Service] Type=oneshot ExecStart=/bin/bash -c "for f in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor; do echo performance > $f; done" RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF systemctl enable --now cpu-performance.service ``` ### Technical Analysis The instructions create a root-owned systemd unit under `/etc/systemd/system` and enable it at boot. The service executes a shell command that writes to privileged CPU control interfaces for every CPU whenever the system starts. Although selecting the performance governor is related to performance tuning, permanently installing and enabling a system service is not necessary for diagnosis, profiling, or temporary benchmarking. It exceeds least privilege because the same evaluation can be performed using read-only inspection followed by a temporary governor change. The unit content is static in the current file, so there is no demonstrated hidden backdoor. Nevertheless, converting tuning advice into an automatically enabled privileged startup hook creates a dangerous execution boundary. If the unit content is altered before installation, the substituted command would run during startup with system privileges. ### Attack Path 1. A user or agent follows the CPU tuning instructions with root privileges. 2. The instructions overwrite `/etc/systemd/system/cpu-performance.service`. 3. `systemctl enable --now` starts the service and registers it for future boots. 4. The service writes to privileged sysfs CPU controls on every boot. 5. If an attacker can influence the generated unit content or command, the same startup hook can execute arbitr ...[truncated 558 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: references/memory.md:144
Finding: Persistent Global Transparent Huge Page Modification
Content: View full analysis
/etc/systemd/system/disable-thp.service << 'EOF' [Unit] Description=Disable Transparent Huge Pages After=network.target [Service] Type=oneshot ExecStart=/bin/sh -c "echo never > /sys/kernel/mm/transparent_hugepage/enabled" ExecStart=/bin/sh -c "echo never > /sys/kernel/mm/transparent_hugepage/defrag" RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF systemctl enable --now disable-thp.service ``` ### Technical Analysis This code installs and enables a boot-time system service that globally disables Transparent Huge Pages and THP defragmentation. The service writes to privileged kernel interfaces and remains registered after the Skill run ends. Disabling THP can be appropriate for selected databases or latency-sensitive applications, but making the setting global and persistent is broader than necessary for general performance analysis. The service does not scope the change to a particular workload, verify that the host actually exhibits THP-related latency, or preserve the original state. As with the CPU service, the current unit contains no hidden malicious payload. The risk arises from creating a persistent root execution mechanism and from applying a global kernel policy based on generic guidance. ### Attack Path 1. A user runs the documented commands with root privileges. 2. A system-level service file is written under `/etc/systemd/system`. 3. The service is immediately started and enabled for all future boots. 4. THP is disabled globally, affecting unrelated applications. 5. If the service body is modified through untrusted context or automation, arbitrary commands can execute as root at boot. ### Impact Assessment The setting affects all processes on the host and survives reboot. Workloads that benefit from THP m ...[truncated 365 chars]
Remediation: View remediation
/sys/kernel/mm/transparent_hugepage/enabled echo always > /sys/kernel/mm/transparent_hugepage/defrag ``` - Restore the recorded original values rather than always using `always`. - Where possible, use application-specific `madvise` behavior instead of a host-wide setting. ]]>

T06 · System Persistence

Error

Location: references/disk_io.md:76
Finding: Persistent Disk Services, Timer, Cron Job, Udev Rules, and Startup Script
Content: View full analysis
/etc/udev/rules.d/60-ioscheduler.rules << 'EOF' # NVMe SSD ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/scheduler}="none" # SATA SSD ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/scheduler}="mq-deadline" # HDD ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ATTR{queue/scheduler}="bfq" EOF udevadm control --reload-rules && udevadm trigger ``` ```bash # 持久化 cat > /etc/rc.local << 'EOF' #!/bin/bash blockdev --setra 4096 /dev/sda EOF chmod +x /etc/rc.local ``` ```bash # 持久化（udev 规则） cat >> /etc/udev/rules.d/60-ioscheduler.rules << 'EOF' ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/nr_requests}="256" ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/nr_requests}="1024" EOF ``` ```bash # 开启定时 TRIM（systemd timer） systemctl enable fstrim.timer systemctl start fstrim.timer ``` ```bash # 开启 SMART 后台监控（smartd） systemctl enable --now smartd # 配置 /etc/smartd.conf 发现问题时发邮件 # 添加定期检查到 crontab echo "0 3 * * 0 smartctl -a /dev/sda > /var/log/smart-sda-$(date +\%Y\%W).log" >> /etc/crontab ``` ### Technical Analysis The document introduces several independent cross-session mechanisms: - Global udev rules that modify I/O schedulers and queue depths. - An executable `/etc/rc.local` startup script. - An enabled systemd TRIM timer. - An enabled SMART monitoring daemon. - A recurring command appended to the system crontab. Some mechanisms, particularly `fstrim.timer` and `smartd`, have legitimate administration uses. However, automatically enabling them is not required for performance diagnosis. The udev and startup modifications also hard-code device classes and `/dev/sda`, which may not correspond to ...[truncated 1518 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bench-compare.sh:43
Finding: Arbitrary Shell Command Execution in Benchmark Utility
Content: View full analysis
&2 for arg in "$@"; do echo " $arg" >&2 done echo "" >&2 # 非交互模式（管道/重定向）跳过确认 if [ "$NON_INTERACTIVE" = true ]; then echo "(非交互模式，跳过确认)" >&2 elif [ -t 0 ]; then echo "按 Enter 继续，Ctrl+C 取消..." >&2 read -r fi } ``` ```bash run_timed() { local cmd="$1" local n="$2" local label="$3" local times=() echo "运行 $label ($n 次)..." >&2 for i in $(seq 1 "$n"); do start=$(date +%s%N) bash -c "$cmd" > /dev/null 2>&1 end=$(date +%s%N) elapsed=$(( (end - start) / 1000000 )) # ms times+=("$elapsed") ``` ### Technical Analysis The script accepts a complete command string from command-line arguments and evaluates it through `bash -c`. Shell metacharacters, substitutions, pipelines, redirections, and command separators are therefore interpreted as executable syntax. This interface may be intentional for flexible benchmarking, but it is unsafe when benchmark commands originate from untrusted task text, generated agent output, CI variables, issue descriptions, or configuration files. The confirmation control does not establish trust: it is skipped when standard input is non-interactive and can be explicitly bypassed with `--no ...[truncated 1208 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: references/java_performance.md:77
Finding: Unpinned Remote Profiling Tools and Dependencies Are Downloaded for Local Execution
Content: View full analysis
# 内存分配火焰图 ./asprof -d 30 -e alloc -f alloc-flame.html # 锁竞争分析 ./asprof -d 30 -e lock -f lock-flame.html ``` ```bash # 下载启动 curl -O https://arthas.aliyun.com/arthas-boot.jar java -jar arthas-boot.jar ``` ```bash npx clinic doctor -- node app.js npx clinic flame -- node app.js ``` ```text pip install pyyaml openai ``` ### Technical Analysis The Skill recommends downloading executable profiling tools and installing packages without consistently pinning immutable versions or verifying signatures or checksums. The async-profiler URL uses the apparent official project organization on GitHub rather than a personal paste site. However, the use of a `latest` release route makes the retrieved artifact mutable after the Skill has been reviewed. The Arthas JAR is downloaded and directly executed without integrity validation. `npx` can retrieve and run packages dynamically, while unversioned `pip install` commands permit dependency versions to change over time. This creates a time-of-check/time-of-use supply-chain gap: the code that eventually runs is not contained in the audited project and can change independently. ### Attack Path 1. A user follows the profiling setup instructions. 2. A mutable release, package registry, hosting account, DNS path, or upstream build is compromised or changes unexpectedly. 3. The user downloads or installs an altered artifact. 4. The artifact is executed through `java -jar`, ` ...[truncated 778 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (162)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a performance-analysis advisor, but it also exposes automated evaluation behavior involving local YAML loading and external OpenAI-compatible API calls. This mismatch weakens user trust and reviewability because operators may grant the skill access expecting diagnostics, while hidden or under-declared behaviors can transmit data externally or perform unrelated automation.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 433)May include surrounding context.
md
1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 443)May include surrounding context.
md
1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 582)May include surrounding context.
md
1. **采集基线** — 运行 `scripts/collect_snapshot.sh` 或手动采集

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
│ └── 内核态高 → perf top / bpftrace → references/ebpf_bpftrace.md

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.
md
│ └── 内核态高 → perf top / bpftrace → references/ebpf_bpftrace.md

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 567)May include surrounding context.
md
│ └── 内核态高 → perf top / bpftrace → references/ebpf_bpftrace.md

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: The rollback example rm /etc/sysctl.d/99-perf-tuning.conf && sysctl --system is a destructive file operation affecting persistent system configuration. In an agent or copy-paste workflow, a generic delete command can remove legitimate settings wholesale, causing service regressions or security/performance drift beyond the single parameter being rolled back.
Content: Scanner excerpt · SKILL.md (reported line 470)May include surrounding context.
回滚

sysctl -w 参数名=原始值 # 临时回滚 rm /etc/sysctl.d/99-perf-tuning.conf && sysctl --system # 持久化回滚

text
---

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: Advising --privileged or SYS_ADMIN in container contexts materially weakens container isolation and can enable host-level compromise if applied broadly. Even though framed as a platform note, recommending such powerful modes without emphasizing safer alternatives normalizes dangerous deployment patterns in exactly the environments where agents may be trusted to guide operations.
Content: Scanner excerpt · SKILL.md (reported line 549)May include surrounding context.
md
| 平台 | 注意事项 | |------|---------| | **容器/K8s** | 需 `--privileged` 或 `SYS_ADMIN` 才能运行 perf/eBPF；cgroup 限制需宿主机/平台侧修改 | | **Windows** | `perf` 不可用，用 ETW/xperf；Python multiprocessing 需 `if __name__ == '__main__'` | | **macOS** | 无 `perf`/eBPF，用 Instruments.app 或 `dtrace` | | **WSL2** | perf 可能需要自行编译匹配内核版本 |

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/c_cpp_performance.md (reported line 132)May include surrounding context.
BSan | 未定义行为 | < 1.5x | GCC/Clang | | MSan | 未初始化内存读 | 3x | 仅 Clang |

⚠️ ASan 与 TSan 不能同时使用；ASan 与 MSan 不能同时使用。

1.4 gperftools（Google Performance Tools）

bash
# 安装 apt install google-perftools libgoogle-perftools-dev # Debian/Ubuntu yum install gperftools gperftools-devel # CentOS/RHEL # CPU Profiler LD_PRELOAD=/usr/lib/libprofiler.so CPUPROFILE=cpu.prof ./myapp google-pprof --text ./myapp cpu.prof # 文本报告 google-pprof --svg ./myapp cpu.prof > cpu.svg # SVG 火焰图 google-pprof --web ./myapp cpu.prof # 浏览器查看 # Heap Profiler LD_PRELOAD=/usr/lib/libtcmalloc.so HEAPPROFILE=heap.prof ./myapp google-pprof --text ./myapp heap.prof.0001.heap # tcmalloc 替换 glibc malloc（性能提升显著） LD_PRELOAD=/usr/lib/libtcmalloc_minimal.so ./myapp

1.5 Intel VTune / AMD uProf

bash
# Intel VTune（性能分析黄金标准） vtune -collect hotspots

Context Leakage

High

Category: Data Exfiltration
Confidence: 75% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · references/c_cpp_performance.md (reported line 151)May include surrounding context.
md
# Intel VTune（性能分析黄金标准） vtune -collect hotspots -result-dir=r001hs ./myapp vtune -collect memory-access -result-dir=r001mem ./myapp vtune -collect threading -result-dir=r001thr ./myapp # AMD uProf AMDuProfCLI collect --config tbp -o /tmp/prof ./myapp

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/container_k8s.md (reported line 587)May include surrounding context.
f("/sys/fs/cgroup/cpu.max");

if (f.is_open()) {

std::string quota_s, period_s;

f >> quota_s >> period_s;

if (quota_s != "max") return std::max(1, std::stoi(quota_s) / std::stoi(period_s));

}

return std::thread::hardware_concurrency();

}

3. 内存分配器选择

glibc malloc 在容器中可能导致内存碎片

推荐：jemalloc 或 tcmalloc

LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so ./app

⚠️ 常见坑：

1. std::thread::hardware_concurrency() 返回宿主机核数

2. /proc/cpuinfo 显示宿主机所有 CPU

3. glibc malloc 的 ARENA 数量默认 = 8 × CPU核数，在容器中会过多

设置 MALLOC_ARENA_MAX=4 限制 arena 数量

MALLOC_ARENA_MAX=4 ./app

text
--- ## Service Mesh 性能影响与优化 ### Sidecar 代理的性能开销 Service Mesh（如 Istio/Linkerd）通过 sidecar 代理拦截所有网络流量，会引入额外延迟和资源消耗： | 指标 | 无 Service Mesh | Istio (Envoy) |

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The fio benchmark examples write a 4G test file to /data/fio_test using direct I/O, but the section does not clearly warn that this can consume space, distort production workloads, trigger latency spikes, or damage user data if the path is mischosen. In a performance-tuning skill, benchmark commands are likely to be executed verbatim, increasing the chance of unsafe use on live data volumes.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: The cleanup command deletes a fixed path under /data without requiring validation that the file was created by the benchmark or that the path is safe. In operational documentation, unconditional deletion commands are dangerous because users may adapt or rerun them in environments where the path points to important data or where shell expansion/path mistakes can cause loss.
Content: Scanner excerpt · references/disk_io.md (reported line 224)May include surrounding context.
md
--runtime=30 --time_based --group_reporting # 清理测试文件 rm /data/fio_test # 性能参考（常见磁盘类型）： # ┌─────────────┬──────────────┬──────────────┬────────────┐

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The note states that containers may need --privileged or broad capabilities such as CAP_SYS_ADMIN to use eBPF. In real deployments, recommending privileged containers materially increases attack surface and can enable container breakout, host compromise, or abuse of kernel instrumentation if the containerized workload is ever compromised. The performance-engineering context makes this more dangerous because operators may copy the guidance directly into production diagnostics or Kubernetes manifests.
Content: Scanner excerpt · references/ebpf_bpftrace.md (reported line 434)May include surrounding context.
md
### 注意事项 - 需要内核 >= 4.9（bpftrace 推荐 >= 5.0） - 容器中需要 `--privileged` 或 `CAP_SYS_ADMIN` + `CAP_BPF` - macOS 不支持 eBPF（用 dtrace 替代） - WSL2 支持但可能需要自编译内核 - 生产环境建议使用 tracepoint 而非 kprobe（更稳定）

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/kernel_params.md (reported line 220)May include surrounding context.
... 逐一回滚

方案2：删除配置文件并重新加载

rm /etc/sysctl.d/99-performance-mastery.conf sysctl --system

注意：已通过 sysctl -w 临时设置的值不会自动还原，需手动回滚

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/memory.md (reported line 79)May include surrounding context.
删除 Swap

swapoff /swapfile rm /swapfile sed -i '/swapfile/d' /etc/fstab

text

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and demonstrates shell, file read/write, and environment-dependent operations but does not declare any explicit tool scope or permissions boundary. In an agent environment, this can lead to over-broad execution authority, making it easier for the skill to run impactful system commands without clear operator consent or sandbox constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description presents the skill role and activation context entirely in Chinese, and the document consistently instructs behavior in Chinese without offering a language choice. This creates a locale/language constraint that is not documented as optional or region-specific, which can violate language preference policy.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: Using npx clinic without pinning a version makes execution dependent on whatever package version is resolved at runtime. This creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code on the host when the skill follows the documented command.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: A second unpinned npx clinic invocation repeats the same supply-chain exposure. Because npx may fetch and execute remote package code dynamically, the host inherits risk from upstream tampering or accidental malicious package substitution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This section includes commands that persist kernel tuning changes and modify /etc/sysctl.d, with rollback examples that can delete config files, but the warning is not colocated with the specific commands. In agent-assisted workflows, nearby missing safeguards increase the chance that users copy or authorize impactful system changes without understanding persistence, service impact, or recovery requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This YAML evaluation file defines all user-facing test names, prompts, and expected outputs in Chinese, which imposes a specific language context across the skill evaluation. There is no indication that users may choose another language or that the locale restriction is intentionally documented as a region-specific constraint.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T06 · System Persistence

T06 · System Persistence

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T03 · Remote Payload Retrieval and Execution

SkillSpector

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Tool Parameter Abuse

回滚

Privileged Container / Container Escape

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

1.4 gperftools（Google Performance Tools）

1.5 Intel VTune / AMD uProf

Context Leakage

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

if (f.is_open()) {

std::string quota_s, period_s;

f >> quota_s >> period_s;

if (quota_s != "max") return std::max(1, std::stoi(quota_s) / std::stoi(period_s));

}

return std::thread::hardware_concurrency();

}

3. 内存分配器选择

glibc malloc 在容器中可能导致内存碎片

推荐：jemalloc 或 tcmalloc

⚠️ 常见坑：

1. std::thread::hardware_concurrency() 返回宿主机核数

2. /proc/cpuinfo 显示宿主机所有 CPU

3. glibc malloc 的 ARENA 数量默认 = 8 × CPU核数，在容器中会过多

设置 MALLOC_ARENA_MAX=4 限制 arena 数量

Missing User Warnings

Tool Parameter Abuse

Privileged Container / Container Escape

Tool Parameter Abuse

... 逐一回滚

方案2：删除配置文件并重新加载

注意：已通过 sysctl -w 临时设置的值不会自动还原，需手动回滚

Tool Parameter Abuse

删除 Swap

Undeclared Tool Scope

Natural-Language Policy Violations

Rp1

Rp1

Missing User Warnings

Natural-Language Policy Violations