通用代理管理

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:00 AM UTC
• Version: 1.0.3

Overview

This proxy-management skill is mostly purpose-aligned, but it downloads and runs an unverified native proxy binary, starts persistent background networking processes, and can change host proxy settings with broad triggers.

Install only if you are comfortable letting an agent download and run a proxy binary, store proxy configuration under your user profile, start long-running background network processes, and potentially alter Windows proxy settings. Prefer a version that verifies downloaded binaries, asks before state-changing actions, tracks only its own process, preserves previous proxy settings, and removes affiliate steering from operational instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:111

Finding

Unverified Remote Binary Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:111-112 and SKILL.md:136-138
Vulnerability Type: Remote executable retrieval without integrity or signature verification
Risk Level: High

Vulnerable Code:

bash

curl -L https://github.com/MetaCubeX/Clash.Meta/releases/download/v1.18.0/mihomo-linux-amd64-alpha-dd4eb63.gz | gunzip > "$PROXY_SKILL_DIR/bin/mihomo"
chmod +x "$PROXY_SKILL_DIR/bin/mihomo"

powershell

Invoke-WebRequest -Uri "https://github.com/MetaCubeX/Clash.Meta/releases/download/v1.18.0/mihomo-windows-amd64-compatible-alpha-dd4eb63.zip" -OutFile "$PROXY_SKILL_DIR\mihomo.zip"
Expand-Archive -Path "$PROXY_SKILL_DIR\mihomo.zip" -DestinationPath "$PROXY_SKILL_DIR\bin"
Remove-Item "$PROXY_SKILL_DIR\mihomo.zip"

Technical Analysis

The installation procedure downloads a native executable from an external GitHub release and subsequently launches it as part of the proxy setup. The download is protected by HTTPS, but the Skill does not verify a cryptographic checksum, a digital signature, or signed release metadata before marking the binary executable.

This behavior is central to the declared automatic-installation feature, but it exceeds the minimum safe implementation because arbitrary downloaded bytes are trusted as executable code. The effective code executed on the host can therefore differ from the content reviewed in the Skill package.

The README identifies MetaCubeX/mihomo as the official repository, whereas the installation command uses the older MetaCubeX/Clash.Meta release path. The README also suggests unspecified GitHub acceleration or mirror services when downloads fail. Such mirrors would further weaken provenance if users or agents substitute them without validation.

Attack Path

1. An attacker compromises the release account, release asset, hosting path, or a third-party mirror selected by the user.
2. The legitimate archive is replaced with an attacker-co ...[truncated 1114 chars]

Remediation

View remediation

Remediation Suggestions

1. Download archives to a newly created temporary file instead of streaming them directly into the executable destination.
2. Publish and pin a separate SHA-256 or stronger digest for every supported operating-system and architecture artifact.
3. Verify the digest before extraction or execution and fail closed if verification fails.
4. Prefer signature verification using trusted, pinned release-signing keys or verified provenance metadata.
5. Reconcile the documented official repository with the actual download source and use a current, authoritative release location.
6. Do not recommend unspecified acceleration or mirror sites. If mirrors are supported, require the same pinned signature or digest verification.
7. Validate archive contents before extraction, including expected filenames and protection against path traversal.
8. Write the verified binary atomically to its final path and grant executable permission only after successful verification.
9. Display the source URL, version, and verified digest to the user before first execution and request confirmation.
10. Run the proxy with ordinary user permissions and explicitly reject installation from an elevated agent context unless elevation is demonstrably required.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:151

Finding

Affiliate Promotion Embedded in Agent Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:151-157
Vulnerability Type: Commercial instruction steering unrelated to the minimum technical workflow
Risk Level: Medium

Vulnerable Content:

text

> **🎉 推荐机场 (使用邀请码可获得优惠)**:
> - 官网: doggygo.xyz / dg6.me
> - 邀请码: `1r2daq2s` (绑定后您可获得佣金收益)
> - 特色: Hysteria2 协议，不限速，解锁 ChatGPT/流媒体
> - 套餐: ¥15.8/月起，年付仅 ¥169.8
> - 提示: 任何服务均有跑路风险，请自行注意防范

The same recommendation is also repeated in README.md:76-87.

Technical Analysis

The operational Skill instructions contain a referral code and a recommendation for a specific commercial proxy subscription provider. This content is not required to install, configure, start, stop, or troubleshoot the proxy software.

Because the text is loaded as instructions for an agent, it may influence the agent to present an incentivized commercial provider as part of a trusted technical setup process. Although the referral relationship is disclosed and the text does not attempt to disable safety controls, it creates a conflict of interest and alters the setup guidance beyond the Skill's minimum functional requirements.

No evidence establishes that the promoted domains are malicious. The risk arises from the insertion of unaudited, commercially motivated instructions into an agent-controlled workflow rather than from a confirmed compromise of the named provider.

Attack Path

1. A user activates the Skill to install or configure a proxy.
2. The agent loads and follows the initialization instructions.
3. During subscription acquisition, the agent presents the embedded provider and referral code.
4. The user treats the recommendation as part of the trusted setup procedure.
5. The user may visit the third-party domains, purchase service, or provide payment and account information to a provider that was not technically audited by this project.

Impact Assessment

This issue does not directly grant operating-sys ...[truncated 492 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove affiliate links, referral codes, pricing claims, and provider endorsements from executable Agent instructions.
2. Let users supply their own subscription provider without steering them toward a named commercial service.
3. If commercial recommendations are retained in human-facing documentation, place them in a clearly separated advertising section that is not loaded as operational agent guidance.
4. Prominently disclose ownership, compensation, and the absence of a security endorsement.
5. Require explicit user opt-in before the agent displays third-party commercial suggestions.
6. Avoid claims about speed, service availability, or content-unblocking capabilities unless independently verifiable.
7. Provide neutral criteria for evaluating providers, including privacy policy, jurisdiction, security practices, data retention, incident history, and payment risk.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:210

Finding

Overbroad Process Termination and Persistent Host Proxy Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:210-233, SKILL.md:242-250, and SKILL.md:323-324
Vulnerability Type: Unsafe process management and broad host networking changes
Risk Level: Medium

Vulnerable Code:

bash

# 清理残留
pkill -9 mihomo 2>/dev/null
rm -f /tmp/mihomo.pid

powershell

# 关闭已有进程
Get-Process -Name "mihomo" -ErrorAction SilentlyContinue | Stop-Process -Force

# 启动
Start-Process -FilePath "$PROXY_SKILL_DIR\bin\mihomo.exe" -ArgumentList "-d","$PROXY_SKILL_DIR","-f","$PROXY_SKILL_DIR\conf\config.yaml" -WindowStyle Hidden

# 设置系统代理 (可选)
netsh winhttp set proxy proxy-server="http=127.0.0.1:7890" bypass-list="localhost;127.0.0.1"

bash

pkill -9 mihomo
rm -f /tmp/mihomo.pid
unset http_proxy https_proxy

powershell

Get-Process -Name "mihomo" -ErrorAction SilentlyContinue | Stop-Process -Force
netsh winhttp reset proxy

bash

# 1. 强制杀掉进程
pkill -9 mihomo

Technical Analysis

The Skill terminates processes by executable name rather than tracking and validating the specific process it launched. Both pkill -9 mihomo and PowerShell's name-based Stop-Process -Force can terminate unrelated Mihomo instances belonging to the same user. Forced termination also prevents graceful shutdown and cleanup.

On Windows, the Skill changes the WinHTTP proxy configuration for the host. This setting can affect applications and services outside the current Skill workflow and may remain active if execution is interrupted before the reset command runs. The comment labels this operation optional, but the command sequence does not show an explicit consent or state-preservation mechanism.

Proxy modification is consistent with the declared functionality, but global process termination and host-wide proxy replacement are broader than necessary for managing one Skill-owned instance.

Attack Path

1. A user invokes proxy startup, shutdown, subscrip ...[truncated 1305 chars]

Remediation

View remediation

Remediation Suggestions

1. Record the PID returned when starting the Skill-owned process in a user-private PID file.
2. Before termination, verify the PID is active and confirm its executable path and command-line arguments match the Skill installation directory.
3. Never terminate processes solely by executable name.
4. Request graceful shutdown through Mihomo's supported control mechanism before using normal process termination.
5. Reserve forced termination for a timed-out, verified Skill-owned process and require explicit user approval where practical.
6. Store PID and state files inside ~/.proxy-skill rather than using a generic /tmp/mihomo.pid path, and enforce restrictive permissions.
7. Obtain explicit user confirmation before modifying WinHTTP settings.
8. Read and securely preserve the previous WinHTTP proxy configuration before changing it.
9. Restore the exact previous configuration on shutdown or failure rather than unconditionally resetting it.
10. Add failure handlers so prior proxy state is restored if startup, connectivity testing, or subsequent configuration steps fail.
11. Prefer process-local proxy environment variables when they satisfy the user's request, as they have a smaller impact than host-level settings.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The description advertises automatic installation and management but does not warn that the skill may download binaries, write files, alter proxy settings, and terminate processes. Users may invoke it without informed consent, leading to unexpected persistence, network interception, or operational disruption.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

# 清理残留
pkill -9 mihomo 2>/dev/null
rm -f /tmp/mihomo.pid

# 启动
nohup "$PROXY_SKILL_DIR/bin/mihomo" -d "$PROXY_SKILL_DIR" -f "$PROXY_SKILL_DIR/conf/config.yaml" > "$PROXY_SKILL_DIR/logs/mihomo.log" 2>&1 &

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md

# 清理残留
pkill -9 mihomo 2>/dev/null
rm -f /tmp/mihomo.pid

# 启动
nohup "$PROXY_SKILL_DIR/bin/mihomo" -d "$PROXY_SKILL_DIR" -f "$PROXY_SKILL_DIR/conf/config.yaml" > "$PROXY_SKILL_DIR/logs/mihomo.log" 2>&1 &

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

md

# 清理残留
pkill -9 mihomo 2>/dev/null
rm -f /tmp/mihomo.pid

# 启动
nohup "$PROXY_SKILL_DIR/bin/mihomo" -d "$PROXY_SKILL_DIR" -f "$PROXY_SKILL_DIR/conf/config.yaml" > "$PROXY_SKILL_DIR/logs/mihomo.log" 2>&1 &

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

Linux/macOS:

bash

pkill -9 mihomo
rm -rf ~/.proxy-skill
echo "已完全卸载"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

Linux/macOS:

bash

pkill -9 mihomo
rm -rf ~/.proxy-skill
echo "已完全卸载"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises automatic installation from GitHub, proxy configuration, troubleshooting, and “完全卸载 - 一键清理，不留痕迹” without clearly warning about system impact such as downloading executables, modifying startup behavior, changing network settings, or deleting installed files/configuration. In this context, the lack of prominent safety/impact disclosure is dangerous because users may trigger significant system modifications without understanding persistence, trust boundaries, or removal consequences.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README defines very broad natural-language triggers such as “开启代理”, “关闭代理”, “换节点”, and “代理挂了” without any scope, confirmation, or precondition requirements. In an agent-driven skill that can install software, stop/start services, and modify network routing, these generic phrases increase the chance of accidental invocation from normal conversation or unrelated troubleshooting context, leading to unintended system changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list is extremely broad and matches many ordinary conversations about proxies, making accidental activation likely. Because the skill performs installation, downloads, file writes, process killing, and proxy reconfiguration, overbroad invocation materially raises the chance of unintended system changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill embeds affiliate/referral promotion and explicitly mentions commission earnings, which is unrelated to core proxy management and introduces a conflict of interest. In an automated assistant context, this can steer users toward third-party services for the author's financial gain, increasing supply-chain and social-engineering risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill directs outbound connectivity tests to an external site through the configured proxy. Even if intended as a health check, this transmits network metadata and may route user traffic through an untrusted proxy configuration immediately after installation.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

bash

"$PROXY_SKILL_DIR/bin/mihomo" -d "$PROXY_SKILL_DIR" -f "$PROXY_SKILL_DIR/conf/config.yaml" &
sleep 3
curl -x http://127.0.0.1:7890 https://www.google.com

Windows:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Launching mihomo with nohup in the background creates a persistent user-session process that continues after the immediate interaction. In this context, persistence is more sensitive because the program mediates network traffic and may keep proxying after the user no longer expects it.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

rm -f /tmp/mihomo.pid

# 启动
nohup "$PROXY_SKILL_DIR/bin/mihomo" -d "$PROXY_SKILL_DIR" -f "$PROXY_SKILL_DIR/conf/config.yaml" > "$PROXY_SKILL_DIR/logs/mihomo.log" 2>&1 &

# 设置环境变量
export http_proxy=http://127.0.0.1:7890

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

curl -s http://127.0.0.1:9090/proxies | jq '.proxies | keys'

切换节点

curl -X PUT http://127.0.0.1:9090/proxies/代理 -H "Content-Type: application/json" -d '{"name":"节点名称"}'

text

**方式二：修改配置文件**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Restarting the proxy with nohup after config edits re-establishes a persistent background network service without an explicit new confirmation step. Because configuration changes may alter routing behavior, silent persistence increases the chance of unintended long-lived traffic interception or outage.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

bash

nano ~/.proxy-skill/conf/config.yaml
# 修改 proxy-groups 中 proxies 的顺序，第一个为默认
pkill -9 mihomo; sleep 1; nohup ~/.proxy-skill/bin/mihomo -d ~/.proxy-skill -f ~/.proxy-skill/conf/config.yaml > ~/.proxy-skill/logs/mihomo.log 2>&1 &

3.5 更新订阅

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

After updating subscription content, the skill immediately restarts the proxy persistently with nohup. This is risky because newly downloaded configuration is trusted and activated in a long-lived background process, compounding both persistence and supply-chain concerns.

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

cp "$PROXY_SKILL_DIR/conf/config.yaml" "$PROXY_SKILL_DIR/conf/config.yaml.bak" curl -s "新订阅链接" | base64 -d > "$PROXY_SKILL_DIR/conf/config.yaml" pkill -9 mihomo; sleep 1 nohup "$PROXY_SKILL_DIR/bin/mihomo" -d "$PROXY_SKILL_DIR" -f "$PROXY_SKILL_DIR/conf/config.yaml" > "$PROXY_SKILL_DIR/logs/mihomo.log" 2>&1 &

text

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The troubleshooting flow again starts a persistent background proxy process automatically. In a fault scenario, users are especially likely to run commands without scrutiny, so silently restoring persistence can perpetuate a bad or malicious configuration.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

md

head -20 ~/.proxy-skill/conf/config.yaml

# 4. 重新启动
nohup ~/.proxy-skill/bin/mihomo -d ~/.proxy-skill -f ~/.proxy-skill/conf/config.yaml > ~/.proxy-skill/logs/mihomo.log 2>&1 &

# 5. 测试
sleep 3

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The rule entries force the proxy target name to the Chinese term "代理" throughout the configuration. This imposes a specific language/locale in user-visible config values without any indication of user opt-in or documented locale justification, which can violate language-choice policy requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.