Security audit

3x-ui Node Manager

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for 3x-ui server administration, but it gives an AI broad remote-control authority while weakening SSH/TLS checks and exposing credentials.

Review carefully before installing. Use only on servers you intend to modify, prefer SSH keys and verified host keys, inspect or pin the upstream 3x-ui installer, enable certificate verification or use a trusted CA, keep servers.yaml out of version control with restrictive file permissions, and expect the skill to open ports, change panel/Xray routing, store credentials locally, and restart services.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to execute shell commands, install software over SSH, fetch and run a remote installer via curl, and modify local configuration files, yet no permissions are declared. This creates a serious trust and policy gap: the skill appears less privileged than it really is, which can lead to unsafe execution, insufficient user consent, and bypass of platform permission controls.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README explicitly tells users that the AI will automatically write panel URLs and credentials into `scripts/servers.yaml`, but it does not prominently warn about the sensitivity of those secrets, local exposure risks, or the consequences of storing them in plaintext. In the context of an AI-executed infrastructure skill that handles remote panel credentials, this omission increases the chance that operators will unknowingly persist high-value secrets on disk and expose them through backups, logs, or local compromise.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README markets fully automatic SSH-based installation, panel setup, node creation, routing changes, and Xray restarts without a prominent warning that these are system-impacting remote administrative actions. In this skill's context, the danger is elevated because the AI is encouraged to perform privileged changes on live servers, so insufficient operator warning can lead to accidental deployment, service disruption, or unsafe execution against the wrong host.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger text includes broad phrases like requests for 'install panel', 'create node', or '3x-ui', which are generic enough to match benign conversation and unintentionally invoke a high-risk skill. Because this skill performs remote administration and networking actions, accidental invocation materially increases the chance of unauthorized or surprising operations.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script disables TLS certificate verification for all panel requests, allowing man-in-the-middle interception or modification of traffic to the 3x-ui panel. In this skill context, those requests carry admin credentials and configuration changes, so an attacker on the network path could steal credentials or inject malicious panel actions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script accepts an SSH password as a command-line argument, exports it to an environment variable, and later prints extracted panel credentials and API token to stdout. This creates multiple disclosure paths: shell history, process listings, logs, CI traces, terminal scrollback, and captured spool/output files. In the context of a skill specifically designed to install panels on remote servers over SSH, this is more dangerous because it handles both server access credentials and newly generated admin credentials for an internet-facing panel.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The script remotely executes code fetched live from a GitHub URL using 'bash <(curl -Ls ...)' on the target server, with no pinning, checksum/signature verification, or user confirmation. If the upstream repository, network path, or referenced branch is compromised, arbitrary code will run as the connected user—likely root based on the prompt handling—resulting in full remote server compromise. The skill context makes this especially dangerous because its purpose is automated server provisioning over SSH, amplifying blast radius across multiple hosts.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pyyaml>=6.0 requests>=2.28 qrcode>=7.4 cryptography>=41.0
Confidence: 95% confidence
Finding: pyyaml>=6.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: pyyaml>=6.0 requests>=2.28 qrcode>=7.4 cryptography>=41.0
Confidence: 95% confidence
Finding: requests>=2.28

Unpinned Dependencies

Low

Category: Supply Chain
Content: pyyaml>=6.0 requests>=2.28 qrcode>=7.4 cryptography>=41.0
Confidence: 92% confidence
Finding: qrcode>=7.4

Unpinned Dependencies

Low

Category: Supply Chain
Content: pyyaml>=6.0 requests>=2.28 qrcode>=7.4 cryptography>=41.0
Confidence: 97% confidence
Finding: cryptography>=41.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/xui_batch.py:451