single-gpu-passthrough

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 9:29 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed guide and script set for single-GPU VM passthrough, but it requires root-level host changes that can shut down the desktop while the VM starts.

Install only if you intentionally want this machine to use single-GPU passthrough and have verified the VM name, PCI device IDs, display manager, and script paths. Starting the configured VM can terminate the active graphical session and unsaved desktop work, so test from a secondary console or remote shell and keep a recovery path before enabling the hook.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Hidden Instructions

High

• Category: Prompt Injection

Content

<topology sockets="1" dies="1" cores="6" threads="2"/>
  </cpu>
  <devices>
    <!-- VFIO GPU Passthrough -->
    <hostdev mode="subsystem" type="pci" managed="yes">
      <source>
        <address domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Kernel parameters are set via `rpm-ostree kargs` (NOT `/etc/default/grub` — bootc is immutable):

```bash
sudo rpm-ostree kargs \
  --append='intel_iommu=on' \
  --append='iommu=pt' \
  --append='rd.driver.blacklist=nouveau' \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Kernel parameters are set via `rpm-ostree kargs` (NOT `/etc/default/grub` — bootc is immutable):

```bash
sudo rpm-ostree kargs \
  --append='intel_iommu=on' \
  --append='iommu=pt' \
  --append='rd.driver.blacklist=nouveau' \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- `/etc` is writable (persists across updates)
- `/usr` is immutable (resets on each deployment update)
- Kernel params are applied via `rpm-ostree kargs` — add/remove requires a reboot
- To add: `sudo rpm-ostree kargs --append='new_param=value'`
- To remove: `sudo rpm-ostree kargs --delete='old_param=value'`
- To replace: `sudo rpm-ostree kargs --replace='old=value' --replace-to='new=value'`
- To view: `rpm-ostree kargs`

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- `/etc` is writable (persists across updates)
- `/usr` is immutable (resets on each deployment update)
- Kernel params are applied via `rpm-ostree kargs` — add/remove requires a reboot
- To add: `sudo rpm-ostree kargs --append='new_param=value'`
- To remove: `sudo rpm-ostree kargs --delete='old_param=value'`
- To replace: `sudo rpm-ostree kargs --replace='old=value' --replace-to='new=value'`
- To view: `rpm-ostree kargs`

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- `/etc` is writable (persists across updates)
- `/usr` is immutable (resets on each deployment update)
- Kernel params are applied via `rpm-ostree kargs` — add/remove requires a reboot
- To add: `sudo rpm-ostree kargs --append='new_param=value'`
- To remove: `sudo rpm-ostree kargs --delete='old_param=value'`
- To replace: `sudo rpm-ostree kargs --replace='old=value' --replace-to='new=value'`
- To view: `rpm-ostree kargs`

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- `/etc` is writable (persists across updates)
- `/usr` is immutable (resets on each deployment update)
- Kernel params are applied via `rpm-ostree kargs` — add/remove requires a reboot
- To add: `sudo rpm-ostree kargs --append='new_param=value'`
- To remove: `sudo rpm-ostree kargs --delete='old_param=value'`
- To replace: `sudo rpm-ostree kargs --replace='old=value' --replace-to='new=value'`
- To view: `rpm-ostree kargs`

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill documents a startup hook that stops the display manager, kills multiple user processes with SIGKILL, unbinds consoles/framebuffer, unloads GPU drivers, and hands the only GPU to a VM, but it does not prominently warn that this will terminate the active desktop session and can disrupt running applications. In an agent-skill context, presenting these steps as routine automation without strong gating increases the chance of accidental host denial-of-service or data loss from forcibly terminated user processes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Become root
sudo -i

# Copy scripts
cp ~/projects/single-gpu-passthrough/hooks/vfio-startup ~/.local/sbin/vfio-startup

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Make executable
chmod +x ~/.local/sbin/vfio-startup ~/.local/sbin/vfio-teardown /etc/libvirt/hooks/qemu

# Create log file
mkdir -p /var/log/libvirt
touch /var/log/libvirt/custom_hooks.log /var/log/libvirt/vfio-startup.log /var/log/libvirt/vfio-teardown.log

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This shell script starts/stops services and invokes external scripts via subprocess execution, which can affect system state. The file contains no confirmation prompt, user-facing disclosure, or explanatory comment/docstring warning about these actions.

Static analysis

No suspicious patterns detected.