Security audit

LadderKit

Security checks for vulnerabilities and agentic risk

Overview

This troubleshooting skill sends original questions and screenshot error text to a remote service without requiring sensitive details to be removed first.

Remove subscription links, passwords, tokens, node addresses, and account details from questions and screenshot text before use. Review the remote MCP connection, or configure a verified local-only integration if your troubleshooting information must stay private.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · index-min.json (reported line 1)May include surrounding context.
json
官方文档站 clashverge.dev","Clash Verge 下载安全","v2rayN FlClash 下载渠道是不是原版","Clash 魔改版安装包","仿冒 Clash Verge","带官方商城的 Clash","Clash Verge 下载站网盘国内镜像","Clash Verge 安装包 SHA256 校验","mac 校验 dmg","FlClash apk 是不是原版","安卓 apk 校验","Get-FileHash","shasum -a 256","sha256sum","FlClash SHA256SUMS","v2rayN .sig 签名","v2rayN-public-key.asc 公钥","gpg --verify v2rayN","gpg: BAD signature","gpg: Can't check signature: No public key","WARNING: This key is not certified with a trusted signature","unknown version 5 Invalid keyring","v2rayN 报毒","FlClash 报毒","Clash Verge setup.exe 报毒","Windows Defender 删除 Clash Verge 内核","Windows 已保护你的电脑","Clash Verge 找不到系统文件 os error","安卓覆盖安装签名不一致","INSTALL_FAILED UPDATE_INCOMPATIBLE","INSTALL_FAILED_UPDATE_INCOMPATIBLE","adb Failure Existing package com.v2ray.ang signatures do not match newer version ignoring","App not installed as package conflicts with an existing package","应用未安装：软件包与现有软件包存在冲突","App Store 上的 Clash Verge","Clash Verge 发布页上没有这个版本号"]},{"id":"webrtc-leak","type":"fa

User text and screenshot contents are sent to a remote MCP service without a privacy warning.

Medium

Category: Output Handling
Confidence: 98% confidence
Finding: The skill requires sending verbatim user text and screenshot error text to a remote MCP service without first checking for sensitive information. Proxy troubleshooting messages can contain subscription URLs, embedded credentials, node addresses, or account details; the later prohibition on echoing secrets does not prevent this outbound disclosure, and even excluded questions are transmitted before scope filtering.
Content: No source excerpt is available for this finding.

Mandatory Chinese-only response templates impose a language without user opt-in.

Medium

Category: Output Handling
Confidence: 97% confidence
Finding: The skill requires exact Chinese prefixes for partial or unsupported answers and an exact Chinese-only response for excluded topics. These requirements apply regardless of the user's language, with no language choice or documented locale justification.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 75% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · index-min.json (reported line 1)May include surrounding context.
json
e 服务模式","Clash Verge 服务模式要不要装","Clash Verge 服务模式安全性","clash-verge-service","clash_verge_service","Clash Verge Service 系统服务","TUN 模式需要系统服务","Clash Verge 服务装不上","Clash Verge 修复服务失败","Clash Verge 服务模式卸载","Clash Verge 卸载服务","Clash Verge 卸载服务失败","Clash Verge 切回用户模式","clash-verge-service-uninstall","uninstall-service.exe 找不到","Clash Verge /bin/uninstall-service 找不到","clash-verge-service 退出 Clash Verge 后还在后台运行","Linux 重启后 Clash Verge 服务模式要重装","Linux deb 升级后 Clash Verge 服务模式没了","Clash Verge Linux 没有 pkexec 服务装不上","sudo: a terminal is required to read the password","Clash Verge 以管理员身份运行不装服务","C 盘 Everyone 权限 Clash Verge 服务装不上","服务内核未通过安全检查 Sidecar","Clash Verge 服务无法确认内核及所在目录是否安全已拒绝高权限运行","Clash Verge 服务拒绝启动内核应用数据目录的所有者不是当前账户","Clash Verge 系统服务当前不可用继续使用 Sidecar","core path is writable by group or other","core path is not owned by root","has an untrusted write ACE","is writable by an account other than SYSTEM, Administrators or TrustedInstaller","is owned by an account other than SYSTEM, A

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · index-min.json (reported line 1)May include surrounding context.
json
(Whitelist)","v2rayNG 黑名单 (Blacklist)","v2rayNG 将删除现有的规则集","v2rayNG 锁定中，导入预设时不删除此规则","v2rayNG 改路由后要重连","v2rayNG 让某个网站直连","v2rayNG VPN 模式照样按规则分流"]},{"id":"v2rayn-tun-no-internet","type":"troubleshoot","title":"v2rayN 开了 TUN 就断网、开关弹回或重启后自己关了：权限、旧版 TUN 保护与信息栏报错","aliases":["v2rayN 开 TUN 上不了网","v2rayN 开启 Tun 后无法上网系统代理可以","v2rayN 启用 Tun 断网","v2rayN 旧版 TUN 保护","v2rayN Legacy TUN Protect","v2rayN xray tun 断网","v2rayN sing-box tun 断网","v2rayN 启用 Tun 以管理员身份重启","v2rayN 以非管理员身份运行","v2rayN macOS 开 TUN 要输 sudo 密码","v2rayN Linux 开 TUN sudo 密码","v2rayN 系统的 sudo 密码密码错误，请重试","v2rayN 重启后 Tun 自己关了","v2rayN 每次都要重新输密码开 Tun","failed to open geosite.dat","bin/xray/geosite.dat: no such file or directory","v2rayN xray tun geosite.dat 找不到","failed to add system route","v2rayN Linux 禁用 IPv6 开 TUN 起不来","Xray TUN 的 IPv6 全网段 /0 路由加不上","initial rule-set","v2rayN sing-box 规则集 rule-set 拉不到 TUN 起不来","v2rayN TUN ping 0ms 打不开网页","v2rayN 绑定网口 Hyper-V WSL 多网卡 TUN 断网","v2rayN Tun 模式严格路由"]},{"id":"v2rayng-first-run","typ

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · index-min.json (reported line 1)May include surrounding context.
json
lacklist)","v2rayNG 将删除现有的规则集","v2rayNG 锁定中，导入预设时不删除此规则","v2rayNG 改路由后要重连","v2rayNG 让某个网站直连","v2rayNG VPN 模式照样按规则分流"]},{"id":"v2rayn-tun-no-internet","type":"troubleshoot","title":"v2rayN 开了 TUN 就断网、开关弹回或重启后自己关了：权限、旧版 TUN 保护与信息栏报错","aliases":["v2rayN 开 TUN 上不了网","v2rayN 开启 Tun 后无法上网系统代理可以","v2rayN 启用 Tun 断网","v2rayN 旧版 TUN 保护","v2rayN Legacy TUN Protect","v2rayN xray tun 断网","v2rayN sing-box tun 断网","v2rayN 启用 Tun 以管理员身份重启","v2rayN 以非管理员身份运行","v2rayN macOS 开 TUN 要输 sudo 密码","v2rayN Linux 开 TUN sudo 密码","v2rayN 系统的 sudo 密码密码错误，请重试","v2rayN 重启后 Tun 自己关了","v2rayN 每次都要重新输密码开 Tun","failed to open geosite.dat","bin/xray/geosite.dat: no such file or directory","v2rayN xray tun geosite.dat 找不到","failed to add system route","v2rayN Linux 禁用 IPv6 开 TUN 起不来","Xray TUN 的 IPv6 全网段 /0 路由加不上","initial rule-set","v2rayN sing-box 规则集 rule-set 拉不到 TUN 起不来","v2rayN TUN ping 0ms 打不开网页","v2rayN 绑定网口 Hyper-V WSL 多网卡 TUN 断网","v2rayN Tun 模式严格路由"]},{"id":"v2rayng-first-run","type":"howto","title":"第一次用 v2ra

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · index-min.json (reported line 1)May include surrounding context.
json
删除现有的规则集","v2rayNG 锁定中，导入预设时不删除此规则","v2rayNG 改路由后要重连","v2rayNG 让某个网站直连","v2rayNG VPN 模式照样按规则分流"]},{"id":"v2rayn-tun-no-internet","type":"troubleshoot","title":"v2rayN 开了 TUN 就断网、开关弹回或重启后自己关了：权限、旧版 TUN 保护与信息栏报错","aliases":["v2rayN 开 TUN 上不了网","v2rayN 开启 Tun 后无法上网系统代理可以","v2rayN 启用 Tun 断网","v2rayN 旧版 TUN 保护","v2rayN Legacy TUN Protect","v2rayN xray tun 断网","v2rayN sing-box tun 断网","v2rayN 启用 Tun 以管理员身份重启","v2rayN 以非管理员身份运行","v2rayN macOS 开 TUN 要输 sudo 密码","v2rayN Linux 开 TUN sudo 密码","v2rayN 系统的 sudo 密码密码错误，请重试","v2rayN 重启后 Tun 自己关了","v2rayN 每次都要重新输密码开 Tun","failed to open geosite.dat","bin/xray/geosite.dat: no such file or directory","v2rayN xray tun geosite.dat 找不到","failed to add system route","v2rayN Linux 禁用 IPv6 开 TUN 起不来","Xray TUN 的 IPv6 全网段 /0 路由加不上","initial rule-set","v2rayN sing-box 规则集 rule-set 拉不到 TUN 起不来","v2rayN TUN ping 0ms 打不开网页","v2rayN 绑定网口 Hyper-V WSL 多网卡 TUN 断网","v2rayN Tun 模式严格路由"]},{"id":"v2rayng-first-run","type":"howto","title":"第一次用 v2rayNG（安卓）：导入订阅、更新出节点、允许

Several routing aliases are generic onboarding phrases without a proxy-client qualifier.

Low

Category: Trigger Abuse
Confidence: 88% confidence
Finding: The first-run-setup entry includes aliases such as “第一次怎么用” (how do I use it for the first time), “怎么开始用” (how do I get started), and “后面还要设置什么” (what else needs configuring). Although the entry title names Clash Verge Rev, these aliases do not specify that context or require it to be established, so unrelated onboarding requests could match.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.