3x-ui Node Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.1.2

Overview

This skill is purpose-aligned for remote 3x-ui administration, but it uses unsafe automation patterns that can expose credentials or change servers without strong trust checks.

Review before installing. Use this only on disposable or test servers unless you are comfortable with automated remote administration. Avoid passing passwords in chat or command arguments, do not store panel passwords in plaintext YAML, require HTTPS with valid certificates, verify SSH host keys, and replace the remote curl-to-bash installer with a pinned and verified source.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/xui_install.sh:39
• Finding: Execution of a Mutable Remote Installer Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/xui_install.sh:39-40`; also prescribed by `SKILL.md:21-24` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```tcl "~#" { send "bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)\r" } "$ " { send "bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)\r" } ``` The same behavior is explicitly required by the Skill instructions: ```markdown What the script does: 1. SSH login to the server 2. Run `bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)` 3. Automatically accept default installation options ``` ### Technical Analysis The installer is retrieved from the mutable `master` branch and passed directly to Bash through process substitution. The Skill does not pin an immutable commit, validate a cryptographic checksum, verify a signature, or provide a local reviewed copy of the installer. Consequently, the effective executable payload can change after this Skill has been reviewed. The use of `curl -Ls` also omits `--fail`, so HTTP error handling is not explicit before the response body is passed to Bash. Installing 3x-ui necessarily requires administrative system changes on the destination server, but granting an unverified and mutable remote response immediate shell execution exceeds the minimum safe privilege boundary needed to perform that installation. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, release workflow, or another component capable of changing `master/install.sh`. 2. The attacker inserts arbitrary shell commands into the remote installer. 3. A user invokes `scripts/xui_install.sh` as documented. 4. The script connects to the destination server and retrieves the current attacker-modified installer. 5. Bash executes the response immediately without integrity or authenticity ...[truncated 847 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Vendor a reviewed installer inside the Skill package, or reference an immutable upstream commit rather than `master`. 2. Download the installer to a temporary file instead of piping it directly to Bash. 3. Verify an expected SHA-256 or stronger digest before execution. 4. Prefer a maintainer-signed release and verify its cryptographic signature against a pinned public key. 5. Use strict download options such as: ```bash curl --fail --show-error --location --proto '=https' --tlsv1.2 \ -o "$installer" "$PINNED_URL" ``` 6. Abort installation if download or verification fails. 7. Review the pinned installer and document the exact system changes and privileges it requires. 8. Run installation with the least-privileged account possible, elevating only individual commands that require administrative access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xui_install.sh:28
• Finding: SSH Host Authentication Is Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/xui_install.sh:28` **Vulnerability Type**: Insecure SSH authentication configuration **Risk Level**: High ### Vulnerable Code ```tcl spawn sshpass -e ssh -o StrictHostKeyChecking=no -p $port $user@$ip ``` ### Technical Analysis `StrictHostKeyChecking=no` prevents SSH from requiring trusted host-key verification. This removes the primary mechanism used by SSH clients to authenticate the remote server. Because this workflow also uses password authentication, a machine-in-the-middle or an attacker controlling DNS, routing, or the supplied destination address can impersonate the intended server. The workflow may then disclose the SSH password and execute the installation command on the attacker's host. Disabling host authentication is not necessary for panel installation. Safe noninteractive automation can use a pre-provisioned `known_hosts` entry or a host fingerprint supplied and verified out of band. ### Attack Path 1. An attacker gains a position capable of intercepting or redirecting the SSH connection. 2. The attacker presents an arbitrary SSH host key. 3. The client accepts that key because strict checking is disabled. 4. The automated password authentication is performed against the attacker's SSH endpoint. 5. The attacker captures the SSH credential and observes the installation command. 6. The stolen credential can then be used against the real server if it remains valid. ### Impact Assessment The immediate impact is disclosure of the destination server's SSH credentials and loss of server identity assurance. If the supplied account is privileged, the stolen credentials may provide full administrative control of the destination. The attacker may also return crafted terminal output that is captured and parsed as panel credentials, potentially misleading subsequent automation into registering an attacker-controlled panel. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `StrictHostKeyChecking=no`. 2. Require the expected SSH host-key fingerprint as an installation input and verify it before authentication. 3. Populate a dedicated temporary `known_hosts` file with a previously verified key and use: ```bash ssh -o StrictHostKeyChecking=yes \ -o UserKnownHostsFile="$KNOWN_HOSTS" \ -p "$SSH_PORT" "$SSH_USER@$SSH_IP" ``` 4. Do not treat an unverified `ssh-keyscan` result obtained over the same untrusted network as sufficient authentication; compare it with an out-of-band fingerprint. 5. Prefer public-key authentication through an SSH agent or short-lived certificate instead of automating reusable passwords. 6. Abort on any changed or unknown host key rather than silently accepting it. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xui_batch.py:443
• Finding: TLS Certificate Verification Is Disabled for Panel Administration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/xui_batch.py:24,443` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python import urllib3 urllib3.disable_warnings() ``` ```python for panel in panels: print(f"\n── {panel['name']} ──") s = requests.Session() s.verify = False if proxies: s.proxies = proxies ``` The affected session is subsequently used to authenticate and perform administrative operations, including: ```python resp = session.post(url, json={ "username": panel["username"], "password": panel["password"] }, timeout=30) ``` ### Technical Analysis Setting `s.verify = False` causes all HTTPS requests made through the session to accept untrusted, expired, mismatched, or attacker-generated certificates. Suppressing `urllib3` warnings makes the unsafe condition less visible. The session transmits panel credentials, Reality configuration, private key material, and SOCKS5 credentials. It also modifies Xray routing and invokes the Xray restart API. Therefore, failure to authenticate the panel's TLS endpoint affects both confidentiality and integrity of highly privileged administrative traffic. A private or self-signed panel does not require disabling verification globally. A private CA bundle or pinned certificate can provide authentication without relying on a public certificate authority. ### Attack Path 1. An attacker intercepts traffic between the Skill host and a configured 3x-ui panel, or traffic routed through the configured proxy. 2. The attacker presents any TLS certificate while impersonating the panel. 3. Requests accepts the certificate because verification is disabled. 4. The Skill submits panel credentials to the attacker. 5. The attacker returns plausible API responses and can capture SOCKS5 credentials or manipulate generated configuration data. 6. The stolen panel credentials can be used to administer the real panel and modify prox ...[truncated 472 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `s.verify = False` and do not suppress TLS verification warnings. 2. Use the Requests default certificate validation for publicly trusted certificates. 3. For private panels, allow each panel to specify a trusted CA bundle: ```python s.verify = panel.get("ca_bundle", True) ``` 4. Alternatively, implement certificate or public-key pinning with a securely provisioned expected fingerprint. 5. Reject invalid certificates and fail closed instead of continuing. 6. Require HTTPS for all panel administration. 7. Consider separate sessions and trust configurations for each panel to prevent one panel's trust settings from affecting another. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xui_install.sh:11
• Finding: Sensitive Credentials Are Exposed Through Arguments, Output, Plaintext Configuration, and HTTP Fallback<![CDATA[ ## Vulnerability Details **File Location**: `scripts/xui_install.sh:11-17,69,86-90,105-117`; `scripts/xui_batch.py:416-417`; `SKILL.md:47-48` **Vulnerability Type**: Insecure secret handling and plaintext credential transmission **Risk Level**: High ### Vulnerable Code SSH credentials are accepted as command-line arguments: ```bash if [ $# -ne 4 ]; then echo "用法: $0 <ip> <ssh_port> <username> <password>" exit 1 fi SSH_IP="$1" SSH_PORT="$2" SSH_USER="$3" SSH_PASS="$4" ``` The password is also passed as an argument to Expect: ```bash expect "$EXPECT_SCRIPT" "$SSH_IP" "$SSH_PORT" "$SSH_USER" "$SSH_PASS" 2>&1 | tee "$SPOOL" ``` When certificate setup fails, the installer deliberately converts the panel URL to HTTP: ```bash SSL_FAILED=$(echo "$CLEAN" | grep -i -c 'certificate setup failed\|Failed to issue' || true) if [ "$SSL_FAILED" -gt 0 ]; then ACCESS_URL=$(echo "$ACCESS_URL" | sed 's|^https://|http://|') echo " ⚠️ SSL 证书申请失败，面板使用 HTTP" fi ``` Panel credentials and the API token are printed to standard output: ```bash echo " ✅ 面板安装成功！" echo " ─────────────────────────────" echo " 📍 URL: $ACCESS_URL" echo " 👤 用户: $USERNAME" echo " 🔑 密码: $PASSWORD" echo " 🚪 端口: $PORT" echo " 📁 路径: $WEBPATH" [ -n "$API_TOKEN" ] && echo " 🎫 Token: $API_TOKEN" echo "" echo "--- JSON ---" echo "{\"access_url\":\"$ACCESS_URL\",\"username\":\"$USERNAME\",\"password\":\"$PASSWORD\",\"port\":\"$PORT\",\"webpath\":\"$WEBPATH\",\"api_token\":\"$API_TOKEN\"}" echo "--- END ---" ``` SOCKS5 credentials are likewise accepted through a command-line option: ```python ap.add_argument("--server", required=True, help="Target server name or all") ap.add_argument("--socks5", required=True, help="SOCKS5 exit (ip:port:user:pass)") ``` The Skill instructs users to store reusable panel credentials in plaintext YAML: ```yaml servers: - name: server-1 url: http://<ip>:<port>/<path> username: <user> password: <pass> ``` ### T ...[truncated 2947 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not accept passwords directly in command-line arguments. 2. Read secrets from an interactive hidden prompt, protected file descriptor, SSH agent, operating-system credential store, or secret-management service. 3. Remove the password argument passed to Expect and use a protected environment or pipe only for the minimum required lifetime. 4. Never print panel passwords or API tokens to normal output. Return a redacted result and place any necessary secret into a restricted secret store. 5. Redact credentials from installation transcripts before logging and delete temporary output immediately after use. 6. Require HTTPS for panel URLs. If certificate provisioning fails, abort and require certificate correction rather than falling back to HTTP. 7. Store panel secrets outside `servers.yaml`, referencing secret identifiers or environment-backed credential entries instead. 8. If a local credential file is unavoidable, create it with permissions no broader than `0600`. 9. Add the documented `.gitignore`, but do not rely on it as the primary protection for secrets. 10. Rotate SSH, panel, API, and SOCKS5 credentials that may already have appeared in process listings, logs, or chat transcripts. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1
• Finding: Python Dependencies Are Unpinned and Installed Without Integrity Hashes<![CDATA[ ## Vulnerability Details **File Location**: `scripts/requirements.txt:1-4`; installation prescribed by `SKILL.md:55-57` and `README.md:35-39` **Vulnerability Type**: Non-reproducible third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```text pyyaml>=6.0 requests>=2.28 qrcode>=7.4 cryptography>=41.0 ``` The documented installation command is: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended minimum version constraint. A future package release satisfying the constraint may therefore be installed without any change to the audited Skill. No lock file or package hashes are supplied, and transitive dependency versions are also unconstrained. This prevents reproducible installation and allows the effective dependency code to change after review. If an upstream package account, release process, or configured package index is compromised, a malicious future version can be selected automatically. The listed package names correspond to established packages; the audit found no evidence of typosquatting or an intentionally malicious dependency. The risk arises from mutable resolution and lack of integrity verification. ### Attack Path 1. An upstream package release, maintainer account, or configured Python package index is compromised. 2. A malicious version greater than or equal to the specified minimum is published. 3. A user follows the documented `pip install -r scripts/requirements.txt` command. 4. Pip resolves the malicious version because it satisfies the open-ended constraint. 5. Malicious package installation hooks or imported runtime code execute on the Skill host. 6. That code can access the same local files, configuration, panel credentials, and network privileges available to the Skill process. ### Impact Assessment Exploitation can provide arbitrary code execution with the privileges of the user running `pip` or the Skill. If installation is perform ...[truncated 376 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version. 2. Generate and commit a lock file that also constrains transitive dependencies. 3. Require cryptographic hashes during installation, for example with a hash-locked requirements file and: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Install dependencies in a dedicated virtual environment rather than into the system Python environment. 5. Use a trusted package index or controlled internal mirror. 6. Regularly scan and deliberately update pinned dependencies after reviewing release notes and vulnerability advisories. 7. Record the Python version and target platform so dependency resolution remains reproducible. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The workflow explicitly instructs execution of a remote installer fetched via curl on a server, yet this high-risk behavior is not transparently declared in the skill summary. Undeclared remote code execution on infrastructure is dangerous because users may provide credentials expecting simple panel management while the skill actually installs software from a live third-party source.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The workflow explicitly instructs execution of a remote installer fetched via curl on a server, yet this high-risk behavior is not transparently declared in the skill summary. Undeclared remote code execution on infrastructure is dangerous because users may provide credentials expecting simple panel management while the skill actually installs software from a live third-party source.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill omits a clear upfront warning that it will SSH into servers and execute a remote install script fetched over the network. Given the infrastructure-management context, that omission is especially dangerous because users may unknowingly authorize privileged remote code execution on production or rented servers.

Ae1

High

• Category: analysis-evasion

Content

pip install -r scripts/requirements.txt

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Setting session.verify = False causes all authenticated requests to panel endpoints to skip server certificate validation while the script transmits usernames, passwords, retrieves keys, edits Xray settings, and restarts services. An attacker positioned on the network or controlling DNS/proxy infrastructure could impersonate a panel, steal credentials, return malicious configuration data, or alter the deployed node settings.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly promotes fully automated SSH login, panel installation, and credential handling, but it does not prominently warn that users will be supplying and storing highly sensitive server and panel credentials in plaintext-like workflows. In an AI-driven skill, this increases the chance that credentials are exposed in chat history, local config files, logs, or accidental reuse without the user's informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README normalizes automatic remote installation and node creation but does not clearly warn that the skill can make disruptive system changes, including installing 3x-ui, modifying Xray configuration, adding routes, and restarting services. In this context, users may trigger impactful changes through casual natural-language requests without understanding downtime or configuration risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell and network-capable operations but declares no tool scope or permission boundaries. In this context, that means an agent could be induced to run SSH commands, fetch remote code, or modify local files without explicit capability restriction, increasing the risk of unintended remote administration and secret handling.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Broad activation phrases like requests related to 'install panel, create node, 3x-ui' can cause accidental invocation in contexts where the user did not intend remote admin actions. Because this skill can handle credentials, edit files, and potentially perform server-side installation, ambiguous triggering materially increases the chance of unsafe execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions direct storing panel URLs, usernames, and passwords in a local YAML file without warning about plaintext secret storage, access control, or lifecycle management. In a skill that manages remote panels, such credentials could be exposed through local compromise, backups, logs, or accidental sharing, leading to unauthorized panel access.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script globally disables urllib3 TLS warnings and later disables certificate verification on requests sessions, which suppresses indicators of man-in-the-middle risk. In this skill's context, the tool logs into remote admin panels and pushes configuration changes, so insecure TLS handling directly exposes panel credentials and administrative actions to interception or tampering.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

xray_bin = find_xray_bin()
    if xray_bin:
        try:
            out = subprocess.run([xray_bin, "x25519"], capture_output=True, text=True, timeout=10)
            priv = re.search(r'PrivateKey:\s*(\S+)', out.stdout).group(1)
            pub = re.search(r'PublicKey\):\s*(\S+)', out.stdout).group(1)
            return priv, pub

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

for panel in panels:
        print(f"\n── {panel['name']} ──")
        s = requests.Session()
        s.verify = False
        if proxies:
            s.proxies = proxies

• Confidence: 98% confidence
• Finding: The insecure default of disabling certificate verification is especially dangerous because this script is an administrative automation tool that operates over remote sessions and changes proxy/routing behavior on multiple servers. The skill context increases risk: one unsafe default can compromise several panels at once, leak credentials, and result in unauthorized network redirection or service disruption.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script disables SSH host key verification (`StrictHostKeyChecking=no`) and auto-accepts connection and installation prompts, removing critical trust and review checkpoints. This makes man-in-the-middle attacks, connection to the wrong host, and unsafe default installation choices far more likely, especially because the skill is designed to log into remote servers noninteractively with passwords.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script remotely executes an installer fetched at runtime from GitHub over SSH using `bash <(curl ...)`, which gives the remote content full shell execution on the target server without integrity verification, version pinning, or user confirmation. In this skill’s context—automated installation on arbitrary servers via provided SSH credentials—this significantly increases supply-chain and remote-code-execution risk if the upstream script is compromised, changed unexpectedly, or intercepted.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: Several workflow and safety lines are written in Chinese while the rest of the document is in English, and the skill does not state that it is intended for a Chinese-speaking audience or offer language selection. This can impose a locale/language assumption on users and operators without opt-in.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
requests>=2.28
qrcode>=7.4
cryptography>=41.0

• Confidence: 97% confidence
• Finding: The dependency is specified with only a lower bound (`pyyaml>=6.0`), which allows builds to resolve to different versions over time and makes the installed package set non-reproducible. In a skill that provisions servers and networking software, this increases supply-chain risk and makes it impossible to verify whether a safe version is consistently installed.

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: PyYAML has known historical advisories, and because the manifest does not pin a version, there is no way to confirm that installations avoid affected releases. If the skill parses YAML from user-controlled or remote sources, a vulnerable resolver could enable unsafe parsing behaviors or input-validation issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
requests>=2.28
qrcode>=7.4
cryptography>=41.0

• Confidence: 97% confidence
• Finding: `requests>=2.28` is unpinned, so future installations may pull different releases with different security characteristics. Because this skill appears to interact with remote servers over SSH and likely performs network operations, uncontrolled dependency resolution raises supply-chain and patch-verification concerns.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: Requests has multiple known advisories, and without exact version pinning the project cannot demonstrate that deployed environments avoid affected versions. In a server-management skill that likely makes outbound network requests and may handle credentials, an affected HTTP client could leak secrets or mishandle TLS/session behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
requests>=2.28
qrcode>=7.4
cryptography>=41.0

• Confidence: 95% confidence
• Finding: `qrcode>=7.4` is not version-pinned, which weakens build reproducibility and makes dependency auditing harder. While this package is less security-sensitive than transport or crypto libraries, leaving it floating still exposes the project to unexpected upstream changes or compromised releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
requests>=2.28
qrcode>=7.4
cryptography>=41.0

• Confidence: 98% confidence
• Finding: `cryptography>=41.0` is unpinned despite being a high-sensitivity security library. Allowing arbitrary newer versions without review can introduce incompatible crypto behavior, vulnerable transitive components, or compromised package releases, which is more concerning in a tool that configures secure proxying and server access.

Unverifiable Dependency: cryptography has 16 known advisory(ies) (GHSA-39hc-v87j-747x (Vulnerable OpenSSL included in cryptography wheels); CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: Cryptography has numerous advisories, including issues related to bundled OpenSSL and cryptographic side channels; without pinning, the installed version may be vulnerable and cannot be verified. Given this skill's context of managing panels, nodes, and secure connectivity, weaknesses in a crypto library are more operationally significant than in a generic utility.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The script's comments and runtime messages are written in Chinese only, including usage and status output. This imposes a language choice on users without offering an opt-in, fallback, or documenting that the skill is intentionally limited to a Chinese-speaking audience.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/xui_batch.py:451