Clash VPN

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:08 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for managing Clash, but it gives unsafe network-facing defaults and root configuration update workflows that deserve review before installation.

Install only if you are comfortable with a skill that can guide an agent to modify root-owned Clash configuration and start or stop the proxy service. Before using it, change examples to bind controller and DNS to localhost or a trusted interface, add a controller secret, back up configs, validate temporary files before replacement, and avoid exposing LAN access unless explicitly needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/config-guide.md:13

Finding

Unauthenticated Clash Controller and DNS Service Exposed on All Network Interfaces

Content

View full analysis

Remediation

View remediation

" dns: enable: true listen: 127.0.0.1:53 ``` Additional hardening measures: 1. Generate a strong, unique controller secret and store it with restrictive filesystem permissions. 2. Do not include a real secret directly in public documentation or source control. 3. Restrict controller and DNS ports with host and network firewall rules. 4. If LAN proxy access is required, bind only to a trusted interface and limit access to explicitly approved source networks. 5. Run Clash under a dedicated, unprivileged service account rather than as root where feasible. 6. Document that remote controller exposure requires authentication, TLS or a secure tunnel, and explicit access-control rules. 7. Add a security warning to the configuration guide explaining the consequences of `allow-lan: true` and `0.0.0.0` bindings. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/clash-vpn.sh:103

Finding

Configuration Validation Fails Open and Installs Invalid Configuration Before Verification

Content

View full analysis

&1 | grep -q "Parse config error"; then echo "警告: 配置格式可能有误，请检查" else echo "配置格式验证通过" fi ``` The active configuration is written immediately before this validation: ```bash # 写入新配置 echo "$config_content" > "$CLASH_CONFIG" ``` ### Technical Analysis The script determines validation success by searching command output for the exact text `Parse config error`. It does not reliably use the Clash validator's exit status. The pipeline's status is normally the status of `grep`, not the status of the Clash command. Any validation failure that does not contain that exact English phrase is therefore reported as successful. Relevant cases include: - A different Clash error message. - A localized or version-specific diagnostic. - Semantic configuration errors. - Failure to execute the Clash binary. - A crash or abnormal validator termination. - Read or dependency failures. The script also replaces the active configuration before validation. If validation fails, it only prints a warning and neither restores the backup nor returns a failure status. The invalid or unsafe configuration consequently remains installed. ### Attack Path 1. An operator or automation passes malformed, incompatible, or attacker-influenced YAML to `scripts/clash-vpn.sh update`. 2. The script immediately overwrites `/root/.config/clash/config.yaml`. 3. Clash validation fails but emits output that does not contain the exact string `Parse config error`, or the Clash binary fails to execute. 4. `grep` finds no matching phrase, causing the script to print that validation passed. 5. Automation or the operator trusts the success message and starts or restarts Clash. 6. Clash fails to start, runs with unintended settings, or exposes ...[truncated 869 chars]

Remediation

View remediation

"$tmp_config"; then rm -f "$tmp_config" return 1 fi if ! "$CLASH_BIN" -t -f "$tmp_config"; then echo "Configuration validation failed" rm -f "$tmp_config" return 1 fi if [ -f "$CLASH_CONFIG" ]; then cp --preserve=mode,ownership "$CLASH_CONFIG" \ "$CLASH_CONFIG.bak.$(date +%Y%m%d%H%M%S)" || { rm -f "$tmp_config" return 1 } fi mv -f "$tmp_config" "$CLASH_CONFIG" || { rm -f "$tmp_config" return 1 } echo "Configuration updated and validated" ``` Additional hardening measures: 1. Check the Clash command's exit status directly rather than parsing human-readable output. 2. Return a nonzero status for every validation failure. 3. Preserve the previous active configuration until the new one passes validation. 4. Use `printf` instead of `echo` to avoid implementation-dependent handling of input beginning with options or containing escape sequences. 5. Set restrictive permissions such as mode `0600`, because Clash configurations commonly contain proxy passwords, UUIDs, and subscription credentials. 6. Check backup and replacement operation results instead of continuing after filesystem errors. 7. Consider limiting backup retention and protecting backups with the same restrictive ownership and permissions as the active configuration. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill clearly instructs shell-based operational actions such as starting services, validating configs, and overwriting files, but it does not declare any explicit tool scope or permission boundary. This increases the chance that an agent may execute privileged shell actions without transparent authorization controls, especially in a skill that manages network proxying and root-owned files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill provides a direct example that overwrites /root/.config/clash/config.yaml, a root-owned system configuration file, without any warning, confirmation step, or safety guard. In context, this is more dangerous because the skill is specifically designed to accept user-supplied VPN configuration content, so malformed or malicious input could disrupt networking, reroute traffic, or replace trusted proxy settings at a privileged path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration guide recommends binding administrative and network-facing services to all interfaces via values like external-controller: 0.0.0.0:9090 and dns.listen: 0.0.0.0:53 without any warning, access control guidance, or restriction to trusted hosts. In the context of a VPN/proxy management skill, this is especially dangerous because it can expose a local DNS service and Clash control interface to the LAN or broader network, enabling unauthorized control, information leakage, or use of the proxy by unintended parties.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/clash-vpn.sh (reported line 40)May include surrounding context.

sh

return 1
    fi
    
    nohup "$CLASH_BIN" -f "$CLASH_CONFIG" > "$CLASH_LOG" 2>&1 &
    sleep 2
    
    if pgrep -x "clash" > /dev/null; then

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script writes piped input directly to the Clash configuration file, replacing its contents. Although it creates a backup and prints a success message, there is no upfront user-facing warning or confirmation that the operation will overwrite the active config file under /root/.config/clash/config.yaml.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The visible skill instructions and heading are written in Chinese, with no indication that the skill can respond in other languages or follow the user's preferred locale. Under the policy, language constraints should not be imposed without user opt-in or a clearly documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

All help text, status messages, and operational output are presented only in Chinese, with no option for user language selection. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.