T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup_mirrors.py:37- Finding
Persistent Disabling of pip TLS Verification for the Configured Mirror
- Content
View full analysis
- Remediation
View remediation
Security audit
Cn Dev Setup
Security checks for vulnerabilities and agentic risk
Overview
This skill appears intended to configure China-region development mirrors, but it should be reviewed because it can persistently change package-manager and Docker trust settings in ways that may weaken dependency integrity or overwrite existing configuration.
Install or use this only if you intentionally want persistent China-region mirrors for developer tooling. Run status checks first, avoid --all unless you have reviewed each tool, back up existing Cargo and Docker configuration, avoid GONOSUMDB=* and pip trusted-host unless you understand the tradeoff, and prefer organization-controlled mirrors for production or CI systems.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T08 · Insecure Dependencies
Error
- Location
references/mirrors.md:76- Finding
Global Disabling of Go Module Checksum Database Verification
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/mirrors.md:102- Finding
System-Wide Docker Image Routing Through Unverified Community Mirrors
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup_mirrors.py:203- Finding
Cargo Reset Removes Unrelated User-Defined Source Configuration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/mirrors.md:119- Finding
Documented Docker Setup Overwrites the Entire Privileged Daemon Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill advertises broad one-click support for multiple ecosystems, but the documented behavior reportedly does not implement several claimed actions or only partially handles them. This mismatch can mislead users into trusting that secure or complete configuration changes were applied when they were not, potentially leaving traffic on unintended registries or causing unsafe manual follow-up steps.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs execution of a local Python script that can read and modify persistent developer configuration files and may invoke shell actions, but the skill metadata does not declare any tool scope or allowed tools. This weakens user and platform visibility into what capabilities the skill needs, increasing the risk of unexpected filesystem or command execution side effects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation criteria are broad enough to trigger on many generic development-performance or proxy-related requests, which could cause the skill to run in contexts where the user did not intend persistent environment changes. Because the skill changes package-manager and network settings, overbroad triggering materially raises the chance of unauthorized or surprising configuration modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation recommends a one-click operation that can modify multiple persistent configuration files across package managers and development tools without an explicit upfront warning. This is risky because users may not realize the changes survive future sessions, affect all projects, or alter trusted registries and proxies in ways that impact supply-chain integrity and troubleshooting.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The usage guidance repeats a vague trigger without restating boundaries or a requirement for explicit consent before making persistent changes. In this skill's context, ambiguous invocation is more dangerous because the recommended workflow culminates in modifying developer tooling configuration files across multiple ecosystems.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Setting
GONOSUMDB=*disables checksum database verification for all Go modules, removing an important integrity control against tampered or malicious dependencies. In a mirror-setup skill, this is more dangerous because users are already being redirected to alternate infrastructure, so weakening verification materially increases supply-chain risk.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json <<-'EOF' { "registry-mirrors": [
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json <<-'EOF' { "registry-mirrors": [
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json <<-'EOF' { "registry-mirrors": [
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json <<-'EOF' { "registry-mirrors": [
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python exe = shutil.which(cmd[0]) if not exe: return False, f"{cmd[0]} not found" result = subprocess.run( cmd, capture_output=capture, text=True, timeout=15 ) return result.returncode == 0, result.stdout.strip()
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script persistently modifies ~/.cargo/config.toml without backup, confirmation, or careful merging, which can silently overwrite or alter existing Cargo source configuration. In this skill context, the purpose is to reconfigure developer tooling globally, so the danger is configuration integrity and supply-chain trust rather than direct code execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The reset logic rewrites ~/.cargo/config.toml using line-based section stripping, which can remove unrelated [source.*] configuration and corrupt a user's existing setup. Because this skill is specifically intended to alter development package sources, mistakes here can break builds or redirect dependency resolution in unintended ways, making it a meaningful integrity risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language content throughout the file is Chinese-only, including headings, instructions, and warnings. If organizational policy requires not forcing a specific language without user opt-in, this is a locale/language restriction presented without an alternative or explicit justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script includes Chinese-only user-facing strings in the CLI help and positions the tool specifically as '国内开发环境镜像源配置' without any opt-in or alternative locale. Under the policy, forcing a specific language is a natural-language policy concern unless the locale restriction is explicitly justified or optional.
- Content
Static analysis
No suspicious patterns detected.