ClawHub
Back to skill

Security audit

China Mirrors

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent but should be reviewed because it can permanently redirect future package downloads through third-party mirrors and overwrite existing package-manager settings.

Install only if you intentionally want an agent to change package-manager mirror settings. Prefer project-level configuration, require the exact commands and files before execution, back up existing package-manager and shell config files, and verify that Aliyun, Huawei Cloud, Tsinghua, USTC, or other selected mirrors are acceptable for your security or workplace policy.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Content
**Linux/Mac 全局配置：**
```bash
mkdir -p ~/.pip
cat > ~/.pip/pip.conf << 'EOF'
[global]
index-url = https://mirrors.aliyun.com/pypi/simple/
Confidence
95% confidence
Finding
This command persistently modifies the user's pip configuration under ~/.pip/pip.conf, changing future package installation behavior beyond the current session. Persistent trust and index changes can silently redirect dependency downloads to third-party mirrors, which is risky if mirror integrity, ownership, or user consent is unclear.

Session Persistence

Medium
Category
Rogue Agent
Content
**全局配置：**
```bash
mkdir -p ~/.cargo
cat > ~/.cargo/config.toml << 'EOF'
[source.crates-io]
replace-with = 'aliyun'
Confidence
96% confidence
Finding
Writing ~/.cargo/config.toml creates persistent redirection of crates.io traffic to an alternate registry source for future builds. This affects dependency trust boundaries across projects and may expose users to supply-chain risk if the mirror is stale, compromised, or not explicitly approved.

Session Persistence

Medium
Category
Rogue Agent
Content
#### 3.8 Maven 配置

```bash
mkdir -p ~/.m2
cat > ~/.m2/settings.xml << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<settings>
Confidence
95% confidence
Finding
Creating ~/.m2/settings.xml persistently alters Maven dependency resolution for all future Java builds on the account. Because this changes the global source of downloaded artifacts, it can introduce long-lived supply-chain exposure or break builds if the mirror diverges from upstream.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
**Bundler 项目级配置：**
```bash
bundle config mirror.https://rubygems.org https://mirrors.tuna.tsinghua.edu.cn/rubygems/
echo "✓ Bundler 镜像已配置"
```
Confidence
94% confidence
Finding
Appending environment changes to ~/.bashrc creates shell startup persistence that survives the current session and automatically affects future commands. Although the payload here is not malware, the persistence mechanism is security-relevant because it silently modifies execution environment and network routing over time, especially in a skill that instructs the agent to directly execute commands on the user's machine.

Static analysis

No suspicious patterns detected.