Linux 磁盘健康与备份韧性监控

• Outcome: Review
• Latest audit: Sep 15, 2026 · 11:12 AM UTC
• Version: 1.0.0

Overview

The skill is mostly about disk health monitoring, but it also tells users to force-format a specific partition and persist it in system mounts without adequate safeguards.

Review carefully before installing. The SMART monitoring portions are coherent, but do not follow the formatting or /etc/fstab guidance unless you have independently verified the exact device by stable identifiers, confirmed backups, checked for hidden or damaged filesystems, and accepted that formatting will destroy existing data on the target partition.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:25
• Finding: Unsafe Force-Formatting Guidance Based on an Unreliable Data-Absence Assumption<![CDATA[ ## Vulnerability Details **File Location**: - `SKILL.md:25` - `SKILL.md:57` - `references/disk-health-resilience-case-20260904.md:10` - `references/disk-health-resilience-case-20260904.md:30-35` **Vulnerability Type**: Destructive operation based on insufficient device validation **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:25` states that the absence of a filesystem type proves the absence of data and makes formatting safe: ```text 3. **分区归属判定以 blkid 的 FSTYPE 为准，PARTLABEL 不可信**（本机实测：sda9/sda10 是 xfs 却标 PARTLABEL="NTFS"；sda11 标 "Linux /home partition" 却是无文件系统裸分区）——blkid 无 TYPE 字段 = 无文件系统 = 无数据，可安全格式化 ``` `SKILL.md:57` directs the agent to give the user an exact formatting workflow after relying on `blkid` validation: ```text 1. **mkfs/格式化在 Hermes 无条件 blocklist**——agent 即使 sudo 也执行不了（BLOCKED hardline），必须把精确命令（mkfs+mount+fstab+chown 一条龙）交给用户终端执行。给命令前先自己完成 blkid 验证消除用户疑虑 ``` `references/disk-health-resilience-case-20260904.md:10` repeats the unsafe conclusion: ```text - **sda11 2.4T 裸分区**：PARTLABEL="Linux /home partition" 误导（sda9/sda10 反而标 "NTFS"！）→ blkid 无 TYPE 字段 = 无文件系统 = 零数据 → 判定可安全格式化 ``` `references/disk-health-resilience-case-20260904.md:30-35` provides the destructive command sequence: ```bash sudo mkfs.xfs -f -L backup /dev/sda11 sudo mkdir -p /backup && sudo mount /dev/sda11 /backup echo "UUID=$(sudo blkid -s UUID -o value /dev/sda11) /backup xfs defaults,noatime 0 2" | sudo tee -a /etc/fstab sudo chown <user>:<user> /backup df -hT /backup | tail -1 ``` ### Technical Analysis The guidance incorrectly treats the absence of a `TYPE` value in `blkid` output as proof that a partition contains no data. `blkid` primarily detects recognized filesystem, RAID, swap, and other signatures. A missing result does not establish that the underlying blocks are empty or disposable. Potential explanations for a missing filesystem type include: - A damaged or partially overwritten filesystem signature. - A filesystem or storage format n ...[truncated 2520 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every assertion that a missing `blkid TYPE` value means “no data” or “safe to format.” 2. Replace the conclusion with an explicit warning: an unidentified partition must be treated as potentially containing valuable data until independently verified. 3. Before suggesting formatting, require all of the following: - Confirm the device using stable identifiers such as `/dev/disk/by-id/`, model, serial number, capacity, and partition UUID rather than relying only on `/dev/sdX`. - Verify that the device and all descendants are unmounted. - Inspect the topology with `lsblk -f`, `lsblk -o NAME,PATH,SIZE,TYPE,FSTYPE,FSVER,LABEL,UUID,MOUNTPOINTS,MODEL,SERIAL`. - Perform non-destructive signature inspection with `wipefs -n`, `blkid -p`, and `file -s`. - Check for LVM, RAID, encryption, swap, and active holders using appropriate read-only inspection tools. - Review the partition table and confirm the exact start sector and size. - If unexplained data may exist, create a sector-level image or use recovery tooling before writing to the device. - Confirm that a separate, tested backup exists. 4. Require explicit informed user confirmation that includes the stable device identifier, model, serial number, size, partition number, and a clear warning that formatting destroys data. 5. Do not use `mkfs.xfs -f` by default. Preserve signature-detection safeguards unless an independently verified and documented reason requires force mode. 6. Separate discovery from execution. After validation, generate a proposed command but require the user to re-check the target immediately before execution. 7. Revalidate the target after any reboot, hot-plug event, storage configuration change, or elapsed time because `/dev/sdX` enumeration can change. 8. Do not append to `/etc/fstab` until formatting and mounting have succeeded and the resulting UUID has been independently verified. Also check for an existing duplicate entry befor ...[truncated 19 chars]

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (31)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The document instructs users to run a forced filesystem creation on /dev/sda11 and append a persistent mount entry to /etc/fstab without an explicit, prominent warning about irreversible data loss, boot/mount failure risk, or independent verification steps. In a disk-management skill, these are highly sensitive operations because a wrong device choice or stale partition assumptions can destroy data or leave the system misconfigured across reboots.

Chaining Abuse

High

• Category: Tool Misuse

Content

## 待用户终端执行（agent 被 mkfs hardline block）
```bash
sudo mkfs.xfs -f -L backup /dev/sda11
sudo mkdir -p /backup && sudo mount /dev/sda11 /backup
echo "UUID=$(sudo blkid -s UUID -o value /dev/sda11) /backup xfs defaults,noatime 0 2" | sudo tee -a /etc/fstab
sudo chown <user>:<user> /backup
df -hT /backup | tail -1

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
sudo mkfs.xfs -f -L backup /dev/sda11
sudo mkdir -p /backup && sudo mount /dev/sda11 /backup
echo "UUID=$(sudo blkid -s UUID -o value /dev/sda11) /backup xfs defaults,noatime 0 2" | sudo tee -a /etc/fstab
sudo chown <user>:<user> /backup
df -hT /backup | tail -1
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The manifest description is primarily written in Chinese with embedded English terms, which imposes a language expectation on users. Under the language/locale policy, this is a violation unless the skill offers an explicit language choice or documents a justified locale restriction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 实测采集命令
```bash
# HDD：关注重映射/待映射/离线/命令超时/通电时长/温度
sudo smartctl -a /dev/sda | grep -E 'SMART overall|Reallocated|Current_Pending|Offline_Uncorrect|UDMA_CRC|Power_On_Hours|Temperature_Celsius|Command_Timeout'
# 自检记录（距上次自检太久=自检荒废，如175天）
sudo smartctl -l selftest /dev/sda | tail -5
# NVMe：磨损/备用/温度/错误

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 实测采集命令
```bash
# HDD：关注重映射/待映射/离线/命令超时/通电时长/温度
sudo smartctl -a /dev/sda | grep -E 'SMART overall|Reallocated|Current_Pending|Offline_Uncorrect|UDMA_CRC|Power_On_Hours|Temperature_Celsius|Command_Timeout'
# 自检记录（距上次自检太久=自检荒废，如175天）
sudo smartctl -l selftest /dev/sda | tail -5
# NVMe：磨损/备用/温度/错误

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 实测采集命令
```bash
# HDD：关注重映射/待映射/离线/命令超时/通电时长/温度
sudo smartctl -a /dev/sda | grep -E 'SMART overall|Reallocated|Current_Pending|Offline_Uncorrect|UDMA_CRC|Power_On_Hours|Temperature_Celsius|Command_Timeout'
# 自检记录（距上次自检太久=自检荒废，如175天）
sudo smartctl -l selftest /dev/sda | tail -5
# NVMe：磨损/备用/温度/错误

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 实测采集命令
```bash
# HDD：关注重映射/待映射/离线/命令超时/通电时长/温度
sudo smartctl -a /dev/sda | grep -E 'SMART overall|Reallocated|Current_Pending|Offline_Uncorrect|UDMA_CRC|Power_On_Hours|Temperature_Celsius|Command_Timeout'
# 自检记录（距上次自检太久=自检荒废，如175天）
sudo smartctl -l selftest /dev/sda | tail -5
# NVMe：磨损/备用/温度/错误

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 待用户终端执行（agent 被 mkfs hardline block）
```bash
sudo mkfs.xfs -f -L backup /dev/sda11
sudo mkdir -p /backup && sudo mount /dev/sda11 /backup
echo "UUID=$(sudo blkid -s UUID -o value /dev/sda11) /backup xfs defaults,noatime 0 2" | sudo tee -a /etc/fstab
sudo chown <user>:<user> /backup

• Confidence: 95% confidence
• Finding: This line invokes sudo for mkfs.xfs -f on a block device, which is a privileged and destructive operation. In context, the combination of root execution plus forced formatting can irreversibly erase data if the device identification is wrong or the environment differs from the recorded system state.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 待用户终端执行（agent 被 mkfs hardline block）
```bash
sudo mkfs.xfs -f -L backup /dev/sda11
sudo mkdir -p /backup && sudo mount /dev/sda11 /backup
echo "UUID=$(sudo blkid -s UUID -o value /dev/sda11) /backup xfs defaults,noatime 0 2" | sudo tee -a /etc/fstab
sudo chown <user>:<user> /backup
df -hT /backup | tail -1

• Confidence: 87% confidence
• Finding: Using sudo to create and mount /backup is privileged and can alter live system mount state. While not inherently malicious, it becomes risky in this skill because it is part of an operational sequence that changes storage layout and may be executed without enough validation or rollback guidance.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
sudo mkfs.xfs -f -L backup /dev/sda11
sudo mkdir -p /backup && sudo mount /dev/sda11 /backup
echo "UUID=$(sudo blkid -s UUID -o value /dev/sda11) /backup xfs defaults,noatime 0 2" | sudo tee -a /etc/fstab
sudo chown <user>:<user> /backup
df -hT /backup | tail -1
```

• Confidence: 94% confidence
• Finding: This command obtains a device UUID and appends a new filesystem entry to /etc/fstab with sudo, creating a persistent boot-time configuration change. If the UUID is wrong, duplicated, or the filesystem is unavailable, the system may experience mount failures or degraded boot behavior on subsequent restarts.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ALERT=""

# ---------- sda 机械盘 ----------
OVERALL=$(sudo smartctl -H /dev/sda 2>/dev/null | grep -E 'PASSED|FAILED' | awk '{print $NF}')
TEMP=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Temperature_Celsius/{print $10}')
REALLOC=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Reallocated_Sector_Ct/{print $10}')
PENDING=$(sudo smartctl -A /dev/sda 2>/dev/null | awk '/Current_Pending_Sector/{print $10}')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.