China Dev Environment

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for China-focused developer setup, but it recommends persistent global and system-wide routing changes through third-party infrastructure without enough scoping or rollback guidance.

Review before installing. Use this skill only when you intentionally want China-region mirror/proxy behavior, and prefer per-project settings over global changes. Do not run the Docker or Git global rewrite commands unless you understand that future pulls and clones may route through third-party services; back up existing config first and pin package/image versions for CI or deployment use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Or use nrm to switch between mirrors
npm install -g nrm
nrm use taobao

Technical Analysis

The Skill instructs the agent to install nrm globally without specifying a reviewed version or verifying package integrity. The resolved package and its installation scripts can therefore change after the Skill has been audited.

A global npm installation may execute lifecycle scripts under the invoking user's privileges. If the package, a transitive dependency, or the configured registry is compromised, arbitrary code could execute during installation. Global installation also makes the resulting executable available outside the current project.

Attack Path

1. An attacker compromises the nrm package, one of its transitive dependencies, or the registry serving it.
2. A developer or agent follows the Skill and runs npm install -g nrm.
3. npm resolves the current mutable version rather than a previously reviewed version.
4. Malicious package code or an installation lifecycle script executes with the developer's permissions.
5. The globally installed executable remains available to subsequent shell sessions.

Impact Assessment

Successful exploitation could execute arbitrary commands with the privileges of the user running npm. Accessible data may include source code, user configuration, development credentials, and environment variables. The global installation scope can affect projects beyond the one for which the Skill was invoked.

Remediation

View remediation

Remediation Suggestions

• Pin nrm to a reviewed exact version, for example npm install -g nrm@<reviewed-version>.
• Verify package provenance and published integrity metadata before installation.
• Prefer a project-local development dependency over a global installation.
• Use a committed lockfile where project-local installation is possible.
• Disable lifecycle scripts with --ignore-scripts when they are not required.
• Periodically review the pinned package and its transitive dependency tree.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:239

Finding

Mutable Package Download and Immediate Execution in CI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 239
Vulnerability Type: Unpinned CI dependency execution
Risk Level: High

Vulnerable Code

yaml

    # Deploy to China cloud
    - run: npx tccli scf UpdateFunctionCode ...

Technical Analysis

npx can download a package that is not already installed and immediately execute its CLI. The command does not specify an exact tccli version, use a lockfile-backed local dependency, or verify an integrity digest.

CI runners commonly hold repository tokens, deployment credentials, cloud credentials, and access to build artifacts. Consequently, execution of a compromised mutable package in CI has greater potential impact than the same action in an isolated local environment.

Attack Path

1. An attacker compromises the package resolved as tccli, its dependency chain, or the registry used by the CI runner.
2. A CI job reaches the documented deployment step.
3. npx downloads the current package version and executes it immediately.
4. Malicious code reads CI environment variables, repository tokens, or cloud credentials.
5. The attacker exfiltrates secrets, modifies artifacts, or performs cloud operations allowed by the CI identity.

Impact Assessment

Exploitation could obtain the CI runner's privileges, including access to checked-out source code, build outputs, job secrets, and deployment credentials. If the CI identity can update cloud functions, malicious code could also alter deployed workloads within that identity's authorized scope.

Remediation

View remediation

Remediation Suggestions

• Add the required CLI as a pinned project dependency and commit the corresponding lockfile.
• Invoke the lockfile-resolved binary, such as through an npm script or npx --no-install.
• Pin an exact reviewed version if dynamic installation cannot be avoided.
• Use integrity verification and an approved internal package registry for CI dependencies.
• Restrict deployment credentials to the minimum necessary permissions and expose them only to the deployment step.
• Run dependency installation separately from deployment after security scanning and provenance verification.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:52

Finding

Container Images Routed Through Unverified Third-Party Mirrors

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–59 and 180–184
Vulnerability Type: Unsafe third-party software supply-chain source
Risk Level: High

Vulnerable Code

bash

sudo tee /etc/docker/daemon.json << 'EOF'
{
  "registry-mirrors": [
    "https://docker.1ms.run",
    "https://docker.xuanyuan.me",
    "https://docker.m.daocloud.io"
  ]
}
EOF

The bootstrap workflow repeats the issue:

bash

sudo tee /etc/docker/daemon.json << 'DOCKER'
{
  "registry-mirrors": ["https://docker.1ms.run"]
}
DOCKER

Technical Analysis

These instructions direct Docker image traffic through third-party mirror services. The Skill does not require verification of mirror ownership, image signatures, trusted provenance, or immutable image digests.

TLS protects traffic to the configured mirror but does not establish that content supplied by the mirror is identical to content from the original registry. If a mirror or its infrastructure is compromised, users may receive modified image layers under an expected image name or mutable tag.

Attack Path

1. An attacker compromises a configured mirror, its DNS or hosting infrastructure, or its content synchronization pipeline.
2. The system is configured to use that mirror for subsequent image pulls.
3. A developer pulls an image by name or mutable tag without checking its digest or signature.
4. The mirror supplies an altered image.
5. The image executes during development, testing, CI, or deployment and gains the permissions granted to its container.

Impact Assessment

Impact depends on container privileges and mounted resources. A malicious image could access mounted source code, environment variables, service credentials, network-accessible systems, or Docker-mounted secrets. If launched with elevated privileges, host mounts, or access to the Docker socket, the compromise could extend to the host.

Remediation

View remediation

Remediation Suggestions

• Prefer official registries or mirrors whose ownership and operational controls have been independently verified.
• Maintain an explicit allowlist of approved mirrors rather than presenting arbitrary public endpoints as defaults.
• Pin production and CI images by immutable digest rather than mutable tags.
• Require image signature and provenance verification, such as with Sigstore-compatible tooling.
• Scan downloaded images before execution and enforce admission policies for deployments.
• Avoid privileged containers, Docker socket mounts, and unnecessary host filesystem mounts.
• Document a direct-registry fallback that preserves authenticity checks.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:107

Finding

Global GitHub URL Rewriting Through a Third-Party Proxy

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 107–111 and 189
Vulnerability Type: Global redirection of source-code traffic through a third party
Risk Level: High

Vulnerable Code

bash

# Clone via mirror
git clone https://ghproxy.com/https://github.com/user/repo.git
git clone https://mirror.ghproxy.com/https://github.com/user/repo.git

# Or set URL rewrite
git config --global url."https://ghproxy.com/https://github.com/".insteadOf "https://github.com/"

The project bootstrap repeats the global rewrite:

bash

# 5. Git config for GitHub acceleration
git config --global url."https://ghproxy.com/https://github.com/".insteadOf "https://github.com/"

Technical Analysis

The insteadOf rule silently rewrites every matching GitHub HTTPS URL for the user, including future operations unrelated to the current project. Requests and repository content consequently pass through a third-party service.

The Skill does not require signed-commit verification, release-signature verification, expected commit pinning, or validation of the proxy operator. It also does not warn users against embedding credentials in HTTPS URLs that may be rewritten.

Attack Path

1. The user applies the global insteadOf rule.
2. A later Git operation appears to target https://github.com/..., but Git silently rewrites the destination to the proxy.
3. A compromised or malicious proxy observes the requested repository or supplies modified repository content.
4. The user builds or executes the retrieved source without verifying the expected commit or signature.
5. Malicious code executes with developer or CI permissions.

If credentials are included in a rewritten URL, they may also be disclosed to infrastructure outside GitHub.

Impact Assessment

Successful content substitution could compromise source trees, build scripts, dependencies, and generated artifacts. Subsequent code execution wo ...[truncated 174 chars]

Remediation

View remediation

Remediation Suggestions

• Do not configure third-party URL rewriting globally.

• Use an explicit proxy URL only for a specific clone after informing the user of the trust implications.

• Prefer SSH or an organization-controlled authenticated proxy.

• Pin automated builds to expected commit hashes and verify signed commits or signed release tags.

• Never place access tokens, usernames, or passwords in URLs subject to rewriting.

• Provide removal and inspection commands:

  bash

  git config --global --get-regexp '^url\..*\.insteadOf$'
  git config --global --unset-all \
    url."https://ghproxy.com/https://github.com/".insteadOf
  

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Destructive Replacement of Privileged Docker Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–63 and 178–186
Vulnerability Type: Unsafe privileged configuration modification
Risk Level: Medium

Vulnerable Code

bash

# Configure Docker mirror (daemon.json)
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json << 'EOF'
{
  "registry-mirrors": [
    "https://docker.1ms.run",
    "https://docker.xuanyuan.me",
    "https://docker.m.daocloud.io"
  ]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

The bootstrap workflow performs the same destructive replacement:

bash

if command -v docker &> /dev/null; then
  sudo mkdir -p /etc/docker
  sudo tee /etc/docker/daemon.json << 'DOCKER'
{
  "registry-mirrors": ["https://docker.1ms.run"]
}
DOCKER
  sudo systemctl restart docker
fi

Technical Analysis

tee replaces /etc/docker/daemon.json instead of preserving and merging existing settings. The file may already contain security, authorization, logging, network, storage, runtime, or organization-specific registry configuration.

The workflow then restarts Docker without validating the resulting JSON, requesting confirmation, backing up the original file, or checking whether active workloads will be interrupted. Although Docker configuration is relevant to the Skill's stated purpose, replacing privileged system-wide state is an unsafe implementation.

Attack Path

1. A user runs the documented commands with sudo.
2. Existing Docker daemon configuration is overwritten.
3. Existing security or operational controls in the file are lost.
4. Docker is restarted immediately, interrupting active workloads.
5. Future pulls and daemon behavior use the replacement configuration.

Impact Assessment

This issue does not independently grant new privileges to a remote attacker, but it can remove existing Docker security controls, cause service disruption, and alter behavio ...[truncated 129 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user confirmation before changing system-wide configuration or restarting Docker.
• Back up the existing file with permissions and ownership preserved.
• Parse and structurally merge only the registry-mirrors property rather than replacing the entire document.
• Validate the generated JSON and run dockerd --validate where supported before restarting the service.
• Show the proposed diff and allow the user to decline it.
• Detect active containers and warn about service interruption.
• Provide tested rollback instructions and automatically restore the backup if validation or restart fails.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:111

Finding

Persistent Global Modification of Git Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 111 and 189
Vulnerability Type: Unsafe global configuration scope
Risk Level: Medium

Vulnerable Code

bash

git config --global url."https://ghproxy.com/https://github.com/".insteadOf "https://github.com/"

Technical Analysis

The command permanently modifies user-level Git configuration. The behavior survives completion of the Skill and affects unrelated repositories and future sessions. The bootstrap workflow neither asks for approval nor records the prior configuration for rollback.

This creates a persistent and non-obvious change to a trusted development tool. Users may continue entering normal GitHub URLs without realizing that Git is contacting a different endpoint.

Attack Path

1. The Skill applies the rule to the user's global Git configuration.
2. The Skill finishes, but the rule remains active.
3. A later operation in an unrelated project uses a normal GitHub HTTPS URL.
4. Git silently redirects that operation to the configured proxy.
5. The unrelated project inherits the proxy's confidentiality and integrity risks.

Impact Assessment

The modification affects all matching Git operations performed by the user, not merely the current project. It can redirect source retrieval across projects and sessions until explicitly removed. It does not modify SSH keys, and the audited Skill contains no instruction to read, copy, or transmit SSH private keys.

Remediation

View remediation

Remediation Suggestions

• Prefer repository-local configuration using git config --local when a rewrite is essential.
• Ask for explicit confirmation before creating any global rule.
• Display the effective destination and explain that the change affects future sessions.
• Record existing matching values and provide automatic rollback.
• Prefer one-time explicit clone commands over persistent URL rewriting.
• Include commands to inspect and remove the rule after use.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple
go env -w GOPROXY=https://goproxy.cn,direct

# 2. Create .npmrc for project
cat > .npmrc << 'EOF'
registry=https://registry.npmmirror.com
# For packages that fail on mirror, fallback to official

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple
go env -w GOPROXY=https://goproxy.cn,direct

# 2. Create .npmrc for project
cat > .npmrc << 'EOF'
registry=https://registry.npmmirror.com
# For packages that fail on mirror, fallback to official

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Docker

bash

# Configure Docker mirror (daemon.json)
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json << 'EOF'
{
  "registry-mirrors": [

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Docker

bash

# Configure Docker mirror (daemon.json)
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json << 'EOF'
{
  "registry-mirrors": [

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Docker

bash

# Configure Docker mirror (daemon.json)
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json << 'EOF'
{
  "registry-mirrors": [

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

# Pull image through mirror

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

# Pull image through mirror

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

# Pull image through mirror

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

# Pull image through mirror

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

# Pull image through mirror

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The bootstrap script changes global and system configuration for npm, pip, Go, Git, and Docker, including writing to ~/.pip, global git config, and /etc/docker/daemon.json, without clearly warning that persistent user/system settings will be overwritten. In an automated agent setting, this can silently alter developer environments, break existing workflows, or redirect future package resolution through third-party infrastructure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple
go env -w GOPROXY=https://goproxy.cn,direct

# 2. Create .npmrc for project
cat > .npmrc << 'EOF'
registry=https://registry.npmmirror.com
# For packages that fail on mirror, fallback to official

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The workflow recommends destructive cleanup commands such as removing node_modules and package-lock.json without an explicit warning that local files will be deleted. In an agent-executed context, this can cause unintended data loss or disrupt builds by deleting state the user did not intend to remove.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.