ClawHub
Back to skill

Security audit

Clash Controller

Security checks for vulnerabilities and agentic risk

Overview

The skill is for proxy management, but it asks agents to run an unverified remote installer and manage high-impact network settings with broad triggers.

Review carefully before installing. Only use this skill when you explicitly intend to administer Clash/mihomo on the host. Avoid the documented one-line installer unless you pin and verify the upstream source, and require confirmation before enabling TUN mode, exposing the Web UI, changing subscriptions, or running commands with root privileges.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:20
Finding

Execution of an Unverified Remote Installer from a Mutable Branch

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-22
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The installation instructions retrieve source code through a third-party proxy from the mutable master branch and immediately execute the downloaded installer:

bash
git clone --branch master --depth 1 https://gh-proxy.org/https://github.com/nelvko/clash-for-linux-install.git \
  && cd clash-for-linux-install \
  && bash install.sh

Technical Analysis

The effective installer is not contained in the reviewed project. It is downloaded at invocation time from an external source, meaning its behavior can change after the Skill has been audited. The command also uses the third-party gh-proxy.org relay instead of retrieving content directly from the stated upstream repository.

No immutable commit identifier, release artifact, cryptographic signature, or expected checksum is specified. The downloaded install.sh is then executed without validation. Consequently, compromise of the proxy, compromise of the upstream repository, or a malicious future modification to the master branch could turn the documented installation flow into arbitrary code execution.

The additional recommendation that an unavailable proxy may be replaced with another GitHub acceleration service further increases supply-chain risk because it does not establish trust or integrity requirements for substitute mirrors.

Attack Path

  1. An attacker compromises the third-party proxy, the upstream repository, or the mutable upstream branch.
  2. The attacker modifies the repository content or installer returned by the download route.
  3. A user or agent follows the installation instructions in SKILL.md.
  4. The command clones the attacker-influenced repository without verifying its identity or integrity.
  5. bash install.sh executes the modified payload under the privileges of the ...[truncated 936 chars]
Remediation
View remediation

Remediation Suggestions

  1. Retrieve the project directly from its canonical repository rather than through an unaudited third-party proxy.
  2. Pin the installation source to an immutable, previously reviewed commit hash or a specific signed release instead of master.
  3. Verify the release signature or a checksum obtained through an independent trusted channel before executing any downloaded content.
  4. Review the installer locally before execution and avoid piping or immediately chaining remote retrieval into shell execution.
  5. Run installation with the minimum required privileges. Separate unprivileged download and verification from any narrowly scoped privileged installation steps.
  6. Document the expected repository owner, commit identifier, checksum, and signature verification procedure.
  7. Remove the recommendation to use arbitrary acceleration mirrors. If a mirror is operationally necessary, require an approved mirror and retain end-to-end artifact signature verification.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger scope is overly broad because it activates on generic terms like “代理”, which can appear in many unrelated user requests. This can cause the agent to invoke a high-impact system/network management skill in inappropriate contexts, increasing the chance of unintended proxy reconfiguration, subscription changes, or exposure of network services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.