Eai Dev Setup

• Outcome: Review
• Latest audit: May 28, 2026 · 2:43 PM UTC
• Version: 1.0.0

Overview

This skill is mostly a legitimate Ubuntu development setup helper, but it makes broad persistent system and network-routing changes that users should review before installing.

Install only on a personal Ubuntu machine where you are comfortable with system-wide changes. Review each sudo command, avoid global Git/HuggingFace proxy settings for private code or tokens, back up apt, Docker, shell, and conda configs first, and do not run the CUDA removal or docker group steps unless you intentionally want those long-term effects.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd, shell=False):
    """执行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd,
            shell=shell,
            capture_output=True,

• Confidence: 94% confidence
• Finding: The helper permits subprocess execution with shell=True, and this script actually uses that mode in check_installed_tools() for command strings containing pipes and shell parsing. While the current commands are hardcoded rather than user-controlled, enabling shell execution creates an unnecessary command-injection surface if any future input, environment-derived value, or modified tool check is incorporated into those strings.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs execution of local scripts, shell commands, network downloads, environment-variable changes, and file writes, yet it declares no permissions. This creates a capability/permission mismatch that can lead to over-trusting the skill and unsafe invocation in environments that rely on metadata for policy enforcement.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document promises it 'will not delete any existing files,' but the Docker workflow explicitly includes uninstalling old Docker versions. This misleading safety claim can cause users to authorize destructive system changes under false assumptions, increasing the chance of accidental disruption or data/configuration loss.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Adding a user to the docker group effectively grants root-equivalent access on most Linux systems because Docker can mount the host filesystem, start privileged containers, and escape normal user boundaries. In an environment-setup skill, this materially increases post-install attack surface and should not be done implicitly.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill description says it should be used for broad scenarios like initializing a new system or batch installing tools, without clear boundaries or exclusions. Overly broad triggers increase the chance the agent invokes a high-impact setup workflow in inappropriate contexts, leading to unwanted system-wide modifications.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger section lacks scope limits and negative examples, so the skill can be selected even when the user only needs advice rather than execution. In a setup skill that performs package installs and system reconfiguration, ambiguous applicability materially increases operational risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document instructs users to overwrite system-wide APT and Docker configuration using sudo without caution, validation, or rollback guidance. In a setup skill, this can break package management, alter trust boundaries for software downloads, and affect all users and containers on the machine if the mirror is unreliable or inappropriate for the environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document provides broad purge and deletion commands that can remove GPU drivers, CUDA, cuDNN, and matching files under /usr/local without any explicit warning about service interruption, dependency breakage, or the difficulty of recovery on a remote/dev machine. In an automation/setup skill, users may copy-paste these commands directly, increasing the chance of accidental self-inflicted system disruption.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide recommends sudo kill -9 <PID> for GPU memory recovery without cautioning that SIGKILL immediately terminates the target process, can kill the wrong workload, and may cause data loss or corruption of long-running training jobs. In a developer setup context, GPU processes are often valuable experiments or shared jobs, so this advice is riskier than in a purely disposable lab environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section instructs users to persistently modify system package and Docker configuration under /etc and immediately restart services, but it does not clearly warn about system-wide impact, trust assumptions, rollback steps, or the risk of breaking package/container supply-chain behavior. In a setup skill that automates machine initialization, such changes are especially sensitive because users may apply them wholesale on fresh or production-like systems.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide recommends persistent global Git URL rewriting and shell profile modification without warning that they affect all future GitHub access and all future shell sessions. This can silently redirect downloads through third-party mirrors/proxies, creating integrity, privacy, and troubleshooting risks if the proxy is compromised or behaves unexpectedly.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script gathers and prints a broad inventory of host details, including OS version, kernel, disk usage, GPU/driver information, installed applications, and conda environments, without an explicit warning or consent step describing the sensitivity of that data. In an agent skill context, such inventory can aid fingerprinting, targeting, or unintentional disclosure if logs are shared, stored, or transmitted elsewhere.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

1. **分步执行**：按步骤引导用户完成配置，每步询问是否执行
2. **进度提示**：长时间操作（下载、安装）显示进度信息
3. **用户确认**：涉及 sudo 权限的操作必须用户确认
4. **禁止删除**：不会删除任何已有文件

---

• Confidence: 90% confidence
• Finding: The skill is designed to perform system administration tasks that may require sudo, including package installation and system configuration. Privileged execution is contextually expected here, but it remains dangerous because running externally sourced installers and configuration scripts as root can compromise the host if the content or dependencies are tampered with.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 1. 卸载所有 NVIDIA 相关软件
sudo apt-get --purge remove "*nvidia*" "*cuda*" "*cudnn*"
sudo apt-get autoremove
sudo rm -rf /usr/local/cuda*

# 2. 重启
sudo reboot

• Confidence: 82% confidence
• Finding: This line combines privileged package purging with broad wildcard removals in a way that can substantially disrupt the host, especially on remote systems or shared workstations. While intended for reinstallation, executing these commands as root magnifies the blast radius and can leave the system without GPU drivers or dependent tooling.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Docker 镜像源

```bash
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://2jgearuk.mirror.aliyuncs.com"]

• Confidence: 93% confidence
• Finding: Writing /etc/docker/daemon.json creates persistent host configuration that affects all future Docker operations and survives reboot, but the guide does not highlight that persistence or the trust implications of routing image pulls through a mirror. In this skill context, persistent environment setup is expected, yet still security-relevant because it changes long-term software supply paths.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 1. 卸载所有 NVIDIA 相关软件
sudo apt-get --purge remove "*nvidia*" "*cuda*" "*cudnn*"
sudo apt-get autoremove
sudo rm -rf /usr/local/cuda*

# 2. 重启
sudo reboot

• Confidence: 94% confidence
• Finding: The static rule flags proximity to /usr/local because the command recursively removes directories under a privileged system path. In context the target is CUDA-related paths, but it still represents hazardous parameter use with elevated privileges and can break local compilers, libraries, and dependent applications if the glob matches more than the user expects.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 1. 卸载所有 NVIDIA 相关软件
sudo apt-get --purge remove "*nvidia*" "*cuda*" "*cudnn*"
sudo apt-get autoremove
sudo rm -rf /usr/local/cuda*

# 2. 重启
sudo reboot

• Confidence: 94% confidence
• Finding: The static rule flags proximity to /usr/local because the command recursively removes directories under a privileged system path. In context the target is CUDA-related paths, but it still represents hazardous parameter use with elevated privileges and can break local compilers, libraries, and dependent applications if the glob matches more than the user expects.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/cuda_guide.md:394