ClawHub
Back to skill

Security audit

china-mirror-skills

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stated purpose, but it can make broad persistent system changes and contains under-disclosed safety issues users should review before installing.

Install only if you are comfortable with persistent mirror and package-source changes. Prefer running dry-run first, avoid --yes, check the exact files and global Git rewrites that will change, back up configs separately, and do not run the Homebrew setup path unless you accept executing the live upstream installer. Avoid sharing diagnostic logs without redacting proxy values.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Context-Inappropriate Capability

Low
Confidence
87% confidence
Finding
The helper unconditionally contacts a third-party service (ipinfo.io) and returns public IP/geolocation data during diagnostics. Even if intended for troubleshooting, this discloses environment metadata to an external party and expands the skill's data-sharing surface beyond local-only checks.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The script advertises a restore capability via the --restore flag, but the parsed restore variable is never used and execution still proceeds to write new configuration files. This can cause unintended destructive changes when a user expects rollback, especially in a system-configuration skill that modifies package manager settings and backups.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The help text and interface promise that restore mode will recover prior configuration, but the code ignores restore mode and performs setup operations instead. This mismatch is security-relevant because operators may invoke it during incident recovery or troubleshooting and accidentally overwrite the very state they intended to recover.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill directs users to run setup scripts that alter package manager, network, and tool configuration, including privileged commands, without a prominent warning that these are persistent system changes. Users may unintentionally rewrite registries, mirrors, or docker/apt settings and affect future software installation behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The proxy detection path concatenates and prints raw proxy environment variables, which may include embedded usernames, passwords, tokens, or internal proxy hostnames. Displaying these values to terminal logs or captured session output can leak secrets to other users, logging systems, or support transcripts.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script executes a remote installer directly via `curl ... | bash`, which runs code fetched at execution time without pinning, integrity verification, or an explicit safety warning. Even though it targets the official Homebrew installer, this creates a supply-chain and network interception risk, especially in the stated China-network context where users may rely on mirrors/proxies and face higher chances of traffic manipulation or TLS-intercepting infrastructure.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if is_root; then
            backup_file "$SOURCES_LIST" "apt"
        else
            sudo bash -c "source ${SCRIPT_DIR}/../common.sh && backup_file $SOURCES_LIST apt"
        fi
    fi
Confidence
88% confidence
Finding
sudo

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.