GitHub Hosts CN

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed GitHub hosts updater, but it writes externally supplied network-routing data into the privileged system hosts file with weak safeguards and a likely broken restore path.

Review carefully before installing. Only run this if you intentionally want to change system-wide GitHub DNS resolution, inspect the fetched mappings first with --preview, avoid --yes, and be prepared to manually edit or restore /etc/hosts if the built-in restore path fails.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: update.js:100
• Finding: Unverified Third-Party Host Mappings Are Installed into the Privileged System Hosts File## Vulnerability Details **File Location**: `update.js:100-123`, `update.js:210-229`, `update.js:240-261`, `update.js:299-320`, and `update.js:643-655` **Vulnerability Type**: Unverified remote configuration supply chain **Risk Level**: High The application retrieves mutable host mappings from third-party services and installs data from the fastest responsive source into the system hosts file. The downloaded mappings are not authenticated through signatures, pinned digests, source consensus, trusted address ranges, or post-download user approval. ### Vulnerable Code The remote sources are mutable third-party endpoints: ```js const HOSTS_SOURCES = [ { name: 'HelloGitHub', url: 'https://raw.hellogithub.com/hosts', enabled: true, priority: 1 }, { name: 'GitLab-ineo6', url: 'https://gitlab.com/ineo6/hosts/-/raw/master/hosts', enabled: true, priority: 2 }, { name: 'Gitee-mirror', url: 'https://gitee.com/peng_zhihui/hosts/raw/master/hosts', enabled: true, priority: 3 }, { name: 'Fastly-JSDelivr', url: 'https://cdn.jsdelivr.net/gh/ineo6/hosts@master/hosts', enabled: true, priority: 4 } ]; ``` Redirects are followed without validating the redirect destination, protocol, hostname, or redirect depth: ```js const req = client.get(url, options, (res) => { if (res.statusCode === 301 || res.statusCode === 302) { fetchUrl(res.headers.location, timeout).then(resolve).catch(reject); return; } if (res.statusCode !== 200) { reject(new Error(`HTTP ${res.statusCode}`)); return; } let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => resolve(data)); }); ``` Downloaded entries are accepted based only on a loose IPv4-shaped expression and membership in the GitHub-domain list: ```js function parseGitHubHosts(content) { const entries = []; ...[truncated 5036 chars]
• Remediation: ## Remediation Suggestions 1. **Authenticate downloaded mappings** - Require a cryptographic signature from a pinned maintainer key. - Alternatively, retrieve a versioned artifact and verify it against a trusted, pinned digest before parsing it. - Do not treat HTTPS transport alone as sufficient content authentication. 2. **Require agreement between independent sources** - Compare mappings from multiple independently administered sources. - Install a mapping only when a defined quorum agrees on the address. - Do not select security-sensitive configuration solely by response latency. 3. **Restrict redirects** - Accept only absolute HTTPS redirect URLs. - Enforce an explicit allowlist of permitted redirect hostnames. - Reject redirects to HTTP, loopback, private, link-local, or otherwise unexpected destinations. - Set a strict maximum redirect count. 4. **Strengthen input validation** - Validate IPv4 addresses with a proper address parser and enforce octets in the range 0–255. - Normalize and validate hostnames before comparison. - Use an explicit list of exact hostnames where possible rather than broad wildcard suffixes. - Reject duplicate, conflicting, malformed, loopback, private, multicast, unspecified, and reserved addresses unless expressly required. 5. **Add post-download approval** - Download and validate the data before requesting final confirmation. - Display the selected source and a complete diff of mappings that will be added, changed, or removed. - Require explicit approval after the user has reviewed that diff. - Consider disabling `--yes` for privileged writes or requiring a separate explicit unsafe-automation option. 6. **Reduce privileged operations** - Perform all fetching, parsing, comparison, and validation without elevated privileges. - Elevate only for the final atomic replacement of the hosts file. - Preserve ownership and ...[truncated 280 chars]

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill explicitly modifies /etc/hosts, requires sudo, fetches remote data from multiple sources, and flushes DNS, but the static finding indicates those capabilities are not fully declared in permissions/behavior metadata. That mismatch is dangerous because users or orchestration systems may approve or invoke the skill without understanding it performs privileged file writes, network retrieval, and command execution, increasing the risk of unsafe execution or policy bypass.

Chaining Abuse

High

• Category: Tool Misuse

Content

log('success', 'DNS缓存已刷新 (macOS)');
    } else {
      // Linux: 尝试多个可能的命令
      execSync(`sudo ${cmds.dns} 2>/dev/null || sudo service nscd restart 2>/dev/null`, { stdio: 'ignore' });
      log('success', 'DNS缓存已刷新 (Linux)');
    }
  } catch (e) {

• Confidence: 93% confidence
• Finding: The use of shell chaining with '||' in a sudo execSync command is a true command-chaining abuse pattern. It bundles multiple privileged actions into one shell string, which complicates auditing, broadens the execution surface, and can produce unsafe fallback behavior depending on environment and command availability. In a tool that edits hosts and affects system-wide DNS resolution, this elevated shell chaining materially increases operational and security risk.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The title and description explicitly position the tool as '中国用户专用' and '帮助中国用户', which imposes a locale-specific restriction in natural language. Under the policy, forcing or constraining a specific locale without opt-in or a clearly documented compliance/regional necessity is a language/locale policy concern.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation description is broad enough that the skill could trigger whenever a user mentions GitHub connectivity issues, leading to an invasive action path that modifies a sensitive system file. In context, this is more dangerous than a normal broad trigger because the skill performs privileged system changes and pulls data from external sources, so accidental or premature activation could materially affect the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

console.log('║  4. IP地址可能随时失效，需要定期更新                                    ║');
  console.log('║                                                                        ║');
  console.log('║  This tool will modify system hosts file with these risks:             ║');
  console.log('║  - Requires admin/sudo privileges                                      ║');
  console.log('║  - May affect network access temporarily                               ║');
  console.log('║  - Wrong config may cause DNS issues                                   ║');
  console.log('║  - IPs may expire, need regular updates                                ║');

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

log('success', 'DNS缓存已刷新 (Windows)');
    } else if (platform === 'darwin') {
      // macOS: 需要sudo权限执行DNS刷新
      execSync(`sudo ${cmds.dns}`, { stdio: 'ignore' });
      log('success', 'DNS缓存已刷新 (macOS)');
    } else {
      // Linux: 尝试多个可能的命令

• Confidence: 85% confidence
• Finding: The script executes a shell command via execSync with sudo to flush DNS on macOS. Although the command content is mostly hardcoded, invoking a shell with elevated privileges expands the blast radius of any future code changes, platform/environment quirks, or command-path hijacking, and this tool already performs privileged system modification. In skill context, requesting elevation is expected for hosts updates, but it remains dangerous because it normalizes root execution from network-fetched data workflows.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

log('success', 'DNS缓存已刷新 (macOS)');
    } else {
      // Linux: 尝试多个可能的命令
      execSync(`sudo ${cmds.dns} 2>/dev/null || sudo service nscd restart 2>/dev/null`, { stdio: 'ignore' });
      log('success', 'DNS缓存已刷新 (Linux)');
    }
  } catch (e) {

• Confidence: 91% confidence
• Finding: This Linux path runs a compound shell command under sudo using execSync: one privileged command followed by a fallback with shell operators and redirections. Chained privileged shell execution materially increases risk because shell metacharacters, PATH resolution, and command substitution semantics are in play, making the behavior harder to reason about and easier to abuse if any input or environment becomes controllable. In this skill, the danger is amplified because the tool already downloads remote hosts data and then performs privileged system changes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

execSync(`${cmds.copy} "${safeTempFile}" "${safeHostsFile}"`, { stdio: 'inherit' });
    } else {
      // macOS/Linux: 使用预定义的cp命令，需要sudo权限
      execSync(`sudo ${cmds.copy} "${safeTempFile}" "${safeHostsFile}"`, { stdio: 'inherit' });
    }
    return true;
  } catch (error) {

• Confidence: 88% confidence
• Finding: The tool copies a generated file into the system hosts file using sudo and execSync through a shell command string. Even with path validation and quoting, privileged shell invocation against a system-critical file is risky, especially since the file contents originate from external network sources and the script is designed to alter name resolution for many GitHub-related domains. The context makes this more dangerous than ordinary admin tooling because it changes trust-critical networking behavior across the host.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The restore flow copies the selected backup into a temporary file under CONFIG.tempDir, but copyFromBackup() validates its source path against CONFIG.backupDir. That means restoreBackup() passes a temp-path source that will always fail validation, so the advertised recovery mechanism is broken when users most need it after a privileged hosts modification. In this context, a failed restore increases operational risk because the tool edits a security-sensitive system file and may leave networking impaired without a working rollback path.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if (CONFIG.isWindows) {
      execSync(`${cmds.copy} "${safeBackupPath}" "${safeHostsFile}"`, { stdio: 'inherit' });
    } else {
      execSync(`sudo ${cmds.copy} "${safeBackupPath}" "${safeHostsFile}"`, { stdio: 'inherit' });
    }
    return true;
  } catch (error) {

• Confidence: 87% confidence
• Finding: The restore path also performs privileged shell execution with sudo to overwrite the system hosts file. While restoration is a legitimate function, using elevated shell commands increases the chance of misuse or unexpected behavior, and because restore is the safety mechanism, failure or abuse here can prolong a bad state on the machine. This is less severe than the update path only because the source is intended to be a local backup rather than fresh remote data.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The file repeatedly states '中国用户专用' and '帮助中国用户正常访问GitHub,' which imposes a locale/user-group restriction in natural language rather than offering a user choice. The policy allows locale constraints when clearly justified, but this wording reads as a forced audience restriction instead of an optional region-specific tool selection.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: The package description says the updater is 'for Chinese users' but does not specify when the skill should be invoked or what exact user requests should trigger it. In a manifest/context where descriptions may influence routing, this is too broad and lacks narrowing conditions or negative examples.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The header explicitly states "中国用户专用" (for China users only), which imposes a locale/audience restriction in natural-language guidance rather than offering the user a choice. The file does not present this as an optional mode or provide an opt-in/out mechanism for language/locale targeting.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: update.js:613