ClawHub
Back to skill

Security audit

China Dev Environment

Security checks across malware telemetry and agentic risk

Overview

This is a visible Markdown guide for China-focused development mirrors and proxies, but users should review its global Docker and package-manager configuration commands before running them.

Install only if you want an agent to help configure China-oriented development mirrors and proxy workarounds. Before running the examples, back up existing Docker and package-manager settings, verify each mirror is trusted for your environment, prefer project-local configuration where possible, and manually review any sudo Docker daemon changes before applying them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# 4. Docker mirror (if Docker installed)
if command -v docker &> /dev/null; then
  sudo mkdir -p /etc/docker
  sudo tee /etc/docker/daemon.json << 'DOCKER'
{
  "registry-mirrors": ["https://docker.1ms.run"]
}
Confidence
81% confidence
Finding
The pipeline writes directly to /etc/docker/daemon.json via sudo tee in an automation flow, permanently changing a system-wide registry source to a third-party mirror. If that mirror is compromised or untrusted, subsequent image pulls could be redirected to malicious content, and the privileged write increases blast radius on the host.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.