Security audit

Eai Dev Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Ubuntu development setup purpose overall, but it includes high-impact system changes and unsafe installer patterns that users should review carefully before running.

Install only if you are comfortable with a workstation setup tool that can make persistent system and shell changes. Review each command before running it, avoid the HTTP fishros installer and direct curl-to-shell patterns, do not pass untrusted DEB URLs, mirror URLs, or environment JSON, and prefer official signed repositories, pinned versions, and per-project proxy settings over global configuration.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/tools_guide.md:153
Finding: Plaintext remote installation script is executed with root privileges
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/tools_guide.md:175
Finding: Mutable personal mirror installer is executed directly from the network
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/install_docker.py:188
Finding: Docker mirror URL permits shell-command injection in a privileged configuration path
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/install_package.py:158
Finding: Arbitrary unverified DEB files can be downloaded and installed with root privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/config_env.py:76
Finding: Unescaped environment values enable persistent shell startup injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:55
Finding: Global GitHub URL rewriting routes unrelated repository traffic through a third-party proxy
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup_zsh.py:142
Finding: Unpinned third-party Zsh plugins are enabled as persistent shell startup code
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (129)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 代码的实际主功能是一个“中国网络优化版”的 Docker 安装器，而不是完整的 Ubuntu 算法开发环境初始化工具。虽然 Docker 可能是开发环境的一部分，但当前代码块并未体现算法/深度学习环境配置或批量安装开发工具的广泛能力。相反，它执行了具体且高权限的 Docker 系统配置操作，包括修改 apt 源、写入系统配置文件、启停服务和调整用户组；这些关键能力在描述中没有明确说明。因此描述与该代码块的实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个较高层级的 Ubuntu 算法/深度学习开发环境自动化配置工具，通常应包含系统初始化、源配置、依赖集合安装、开发工具链配置、可能还有国内网络优化等流程。但实际代码行为明显更窄：它只是一个命令行包安装器，支持 apt、本地 deb、URL 下载后安装 deb，并可检查是否已安装。虽然“安装开发工具”可被视为环境配置的一部分，但当前实现既不批量化，也不包含任何与算法开发、深度学习、系统初始化或中国网络优化直接相关的逻辑。因此代码的实际主用途与声明用途存在实质性偏差，应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向 Ubuntu 算法/深度学习开发环境初始化的综合环境配置技能，暗示会安装开发工具链、库或相关系统组件。但代码的主功能是终端 shell 美化与配置，范围限于 zsh、oh-my-zsh、两个插件、.zshrc 主题/插件设置，以及默认 shell 切换。虽然它也属于“环境配置”的一种，但与“算法开发环境”“深度学习开发环境”“批量安装开发工具”相比，主目的明显更窄且不同，构成实质性描述不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明的核心用途是“自动化配置 Ubuntu 算法开发环境”，这意味着应包含安装、设置、初始化或批量配置系统/开发工具的行为。但该代码块仅通过 lsb_release、uname、df、lspci、nvidia-smi、dpkg、conda、nvcc 等命令进行信息探测，并以 JSON 和摘要形式输出结果。它没有修改系统、安装软件、配置镜像源、搭建深度学习环境或批量部署工具。虽然“系统检查”可能是配置流程中的辅助步骤，但该代码块的主要目的与声明的主要功能存在明显偏差，因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
�**：询问用户

命令：

bash
git config --global url."https://gh-proxy.org/https://github.com/".insteadOf "https://github.com/"

验证：

bash
git config --global --get url."https://gh-proxy.org/https://github.com/".insteadOf

2.2 HuggingFace 镜像配置

说明：使用 hf-mirror.com 加速模型下载

是否执行：询问用户

命令：

bash
echo "export HF_ENDPOINT=https://hf-mirror.com" >> ~/.bashrc

验证：

bash
echo $HF_ENDPOINT

时间：约 5 秒

第三步：安装基础工具

目的：安装浏览器、编辑器等日常工具

工具列表：

工具说明时间
Chrome 浏览器约 1 分钟
Edge 浏览器（可选）约 1 分钟
VSCode 代码编辑器约 1 分钟
Cursor AI 编辑器（可选）约 1 分钟
飞书协作工具（可选）约 1 分钟

安装方式：逐个询问用户是否安装

**示�

工具	说明	时间
Chrome	浏览器	约 1 分钟
Edge	浏览器（可选）	约 1 分钟
VSCode	代码编辑器	约 1 分钟
Cursor	AI 编辑器（可选）	约 1 分钟
飞书	协作工具（可选）	约 1 分钟

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/tools_guide.md (reported line 277)May include surrounding context.
�**：询问用户

命令：

bash
git config --global url."https://gh-proxy.org/https://github.com/".insteadOf "https://github.com/"

验证：

bash
git config --global --get url."https://gh-proxy.org/https://github.com/".insteadOf

2.2 HuggingFace 镜像配置

说明：使用 hf-mirror.com 加速模型下载

是否执行：询问用户

命令：

bash
echo "export HF_ENDPOINT=https://hf-mirror.com" >> ~/.bashrc

验证：

bash
echo $HF_ENDPOINT

时间：约 5 秒

第三步：安装基础工具

目的：安装浏览器、编辑器等日常工具

工具列表：

工具说明时间
Chrome 浏览器约 1 分钟
Edge 浏览器（可选）约 1 分钟
VSCode 代码编辑器约 1 分钟
Cursor AI 编辑器（可选）约 1 分钟
飞书协作工具（可选）约 1 分钟

安装方式：逐个询问用户是否安装

**示�

工具	说明	时间
Chrome	浏览器	约 1 分钟
Edge	浏览器（可选）	约 1 分钟
VSCode	代码编辑器	约 1 分钟
Cursor	AI 编辑器（可选）	约 1 分钟
飞书	协作工具（可选）	约 1 分钟

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
python scripts/install_docker.py --install

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.
md
python scripts/install_docker.py --install

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/config_templates.md (reported line 305)May include surrounding context.
果**：

bash
# 克隆仓库会自动通过代理加速 git clone https://github.com/user/repo.git # 实际访问的是 # https://gh-proxy.org/https://github.com/user/repo.git

取消代理：

bash
git config --global --unset url."https://gh-proxy.org/https://github.com/".insteadOf

HuggingFace 镜像（hf-mirror.com）

配置环境变量：

bash
# 添加到 .bashrc echo "export HF_ENDPOINT=https://hf-mirror.com" >> ~/.bashrc source ~/.bashrc

使用方法：

bash
# 下载模型 huggingface-cli download --resume-download gpt2 --local-dir gpt2 # 下载数据集 huggingface-cli download --repo-type dataset --resume-download wikitext --local-dir wikitext # 禁用软链接（所见即所得） huggingface-cli download --resume-download gpt2 --local-dir gpt2 --local-dir-use-symlinks False # 在 Python 代码中使用 from huggingface_hub import snapshot_download snapshot_download(repo_id="bert-base-uncased", local_dir="./bert-base")

**Python

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The documented sudo rm -rf /usr/local/cuda* uses recursive forced deletion with a glob as root, which can remove multiple install trees and any matching paths without confirmation. In a setup guide, this creates a realistic risk of accidental destructive execution and irreversible loss of locally managed CUDA assets.
Content: Scanner excerpt · references/cuda_guide.md (reported line 394)May include surrounding context.
md
# 1. 卸载所有 NVIDIA 相关软件 sudo apt-get --purge remove "*nvidia*" "*cuda*" "*cudnn*" sudo apt-get autoremove sudo rm -rf /usr/local/cuda* # 2. 重启 sudo reboot

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The documented sudo rm -rf /usr/local/cuda* uses recursive forced deletion with a glob as root, which can remove multiple install trees and any matching paths without confirmation. In a setup guide, this creates a realistic risk of accidental destructive execution and irreversible loss of locally managed CUDA assets.
Content: Scanner excerpt · references/cuda_guide.md (reported line 394)May include surrounding context.
md
# 1. 卸载所有 NVIDIA 相关软件 sudo apt-get --purge remove "*nvidia*" "*cuda*" "*cudnn*" sudo apt-get autoremove sudo rm -rf /usr/local/cuda* # 2. 重启 sudo reboot

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The Oh-My-Zsh instructions pipe a remote script directly into sh, which executes unreviewed code immediately from the network. This is a classic unsafe installation pattern that enables remote code execution if the mirror, transport, or account serving the script is compromised.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cuda_guide.md (reported line 118)May include surrounding context.
md
print_progress("正在下载并添加 GPG 密钥...") keyrings_dir = "/etc/apt/keyrings" run_command(["mkdir", "-p", keyrings_dir], use_sudo=use_sudo, check=False, show_output=False) key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cuda_guide.md (reported line 141)May include surrounding context.
md
print_progress("正在下载并添加 GPG 密钥...") keyrings_dir = "/etc/apt/keyrings" run_command(["mkdir", "-p", keyrings_dir], use_sudo=use_sudo, check=False, show_output=False) key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cuda_guide.md (reported line 174)May include surrounding context.
md
print_progress("正在下载并添加 GPG 密钥...") keyrings_dir = "/etc/apt/keyrings" run_command(["mkdir", "-p", keyrings_dir], use_sudo=use_sudo, check=False, show_output=False) key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_docker.py (reported line 115)May include surrounding context.
python
print_progress("正在下载并添加 GPG 密钥...") keyrings_dir = "/etc/apt/keyrings" run_command(["mkdir", "-p", keyrings_dir], use_sudo=use_sudo, check=False, show_output=False) key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_docker.py (reported line 116)May include surrounding context.
python
print_progress("正在下载并添加 GPG 密钥...") keyrings_dir = "/etc/apt/keyrings" run_command(["mkdir", "-p", keyrings_dir], use_sudo=use_sudo, check=False, show_output=False) key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_docker.py (reported line 121)May include surrounding context.
python
print_progress("正在下载并添加 GPG 密钥...") keyrings_dir = "/etc/apt/keyrings" run_command(["mkdir", "-p", keyrings_dir], use_sudo=use_sudo, check=False, show_output=False) key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_docker.py (reported line 127)May include surrounding context.
python
print_progress("正在下载并添加 GPG 密钥...") keyrings_dir = "/etc/apt/keyrings" run_command(["mkdir", "-p", keyrings_dir], use_sudo=use_sudo, check=False, show_output=False) key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_docker.py (reported line 146)May include surrounding context.
python
print_progress("正在下载并添加 GPG 密钥...") keyrings_dir = "/etc/apt/keyrings" run_command(["mkdir", "-p", keyrings_dir], use_sudo=use_sudo, check=False, show_output=False) key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This command chains network retrieval directly into a privileged command with a shell pipeline. In an installer that runs as root or with sudo, that increases supply-chain and command-execution risk because downloaded content is immediately trusted in a security-sensitive operation.
Content: Scanner excerpt · scripts/install_docker.py (reported line 121)May include surrounding context.
python
key_url = "https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg" success, output = run_command( f"curl -fsSL {key_url} | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg", shell=True, use_sudo=False, show_output=False

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This pipeline writes configuration to a root-owned file through the shell, combining command chaining with interpolated data. In context, this is more dangerous because the script is explicitly a privileged system setup tool, so any injection would alter package sources as root.
Content: Scanner excerpt · scripts/install_docker.py (reported line 149)May include surrounding context.
python
repo_content = f"deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu {codename} stable" success, output = run_command( f'echo "{repo_content}" | sudo tee /etc/apt/sources.list.d/docker.list', shell=True, use_sudo=False, show_output=False

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This is the clearest injection point: user-influenced mirror_url is embedded into JSON, then into a single-quoted shell string that is piped to sudo tee. An attacker who controls --mirror-url could potentially break shell quoting and execute arbitrary commands as root, making the context of a setup/installer skill especially dangerous.
Content: Scanner excerpt · scripts/install_docker.py (reported line 204)May include surrounding context.
python
run_command(["mkdir", "-p", "/etc/docker"], use_sudo=use_sudo, check=False, show_output=False) success, output = run_command( f'echo \'{config_content}\' | sudo tee /etc/docker/daemon.json', shell=True, use_sudo=False, show_output=False

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code prints that it is '正在下载并安装 oh-my-zsh' and the function is documented as installing oh-my-zsh, but the command sh -c "curl -fsSL ..." merely runs a shell that executes curl and outputs the installer script text. Because the fetched script is not piped to sh or otherwise executed, the implementation contradicts the stated behavior in the function/docstring and user-facing progress text.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code downloads content from a remote URL and invokes it through a shell-based command path as part of the oh-my-zsh installation flow. Although progress messages are printed, there is no explicit warning at this operation that external code from Gitee/GitHub will be executed, which is a safety-critical network and shell action.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: references/cuda_guide.md:394

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

2.2 HuggingFace 镜像配置

第三步：安装基础工具

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

2.2 HuggingFace 镜像配置

第三步：安装基础工具

Ae1

Ae1

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

HuggingFace 镜像（hf-mirror.com）

Tool Parameter Abuse

Tool Parameter Abuse

Missing User Warnings

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Chaining Abuse

Chaining Abuse

Chaining Abuse

Intent-Code Divergence

Missing User Warnings

Static analysis

Documentation contains a destructive delete command without an explicit confirmation gate.