Linux 磁盘告警治理与扩容分析

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:14 PM UTC
• Version: 1.0.1

Overview

This disk-cleanup skill is purpose-aligned but includes powerful deletion and system-configuration commands that need careful human review before use.

Install only if you want an agent to help with Linux disk administration and you are prepared to review every destructive command first. Do not allow automatic execution of `docker volume prune -f`, `sudo rm -f`, `rm -rf`, partition changes, or `/etc` writes without seeing the exact targets, confirming backups, and approving each step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:33
• Finding: Forced Docker Volume Pruning Can Irreversibly Delete Persistent Data## Vulnerability Details **File Location**: `SKILL.md`, lines 33-35 **Vulnerability Type**: Destructive cleanup without adequate validation or consent **Risk Level**: High ```bash docker builder prune -f # Build cache docker image prune -f # Dangling images only docker volume prune -f # Dangling volumes ``` ### Technical Analysis The Skill presents these operations as the safest cleanup category, but `docker volume prune -f` permanently deletes all local volumes Docker considers unused and suppresses the interactive confirmation prompt. A volume can be detached from every container while still containing valuable database files, application state, backups, or user-generated content. Docker's “unused” determination does not establish that data is obsolete. The procedure does not require a volume inventory, data-owner confirmation, backup, content inspection, or explicit approval before deletion. Access to the Docker daemon also commonly provides privileges comparable to root over Docker-managed resources, so this operation has broader consequences than ordinary user-cache cleanup. ### Attack Path 1. A user invokes the Skill because the host has low disk space. 2. The agent selects the section described as the safest cleanup option. 3. One or more valuable volumes are currently detached from their containers, such as during maintenance or container replacement. 4. The agent executes `docker volume prune -f` without presenting the deletion set or requesting approval. 5. Docker permanently removes the detached volumes and their contents. 6. Applications subsequently fail or lose persistent state when their containers are recreated. ### Impact Assessment The operation can irreversibly destroy databases, application state, backups, and user data stored in detached Docker volumes. The scope is all unused volumes managed by the Docker daemon available to the executing account. It d ...[truncated 191 chars]
• Remediation: ## Remediation Suggestions - Do not describe volume pruning as unconditionally safe. - Remove `-f` from the default documented command so that Docker displays its confirmation prompt. - Inventory volumes with `docker volume ls` and map each candidate to current and historical containers. - Inspect labels, mount points, ownership, and contents before deletion. - Require explicit user approval for the exact named volumes that will be removed. - Back up volumes containing persistent application data before cleanup. - Prefer deleting individually verified volumes with `docker volume rm VOLUME_NAME` rather than globally pruning all unused volumes. - Separate low-risk build-cache cleanup from potentially destructive volume cleanup and clearly label the latter as high risk.

T09 · Insecure Skill Coding Practices

Error

• Location: references/data-dir-migration-softlink-pattern.md:23
• Finding: Directory Migration Deletes the Source After Insufficient Integrity Validation## Vulnerability Details **File Location**: `references/data-dir-migration-softlink-pattern.md`, lines 23-30 **Vulnerability Type**: Unsafe destructive migration procedure **Risk Level**: High ```bash # 3. Background synchronization for a large directory rsync -a --info=progress2 ~/models/ /data/models/ # After completion, compare du -sh output and file counts # 4. Switch after verification: delete the original directory, then create a symbolic link rm -rf ~/models && ln -s /data/models ~/models ls -l ~/models # Confirm that it points to /data/models df -h /home /data # Recheck both partitions ``` ### Technical Analysis The procedure recommends validating the destination using only aggregate size and file-count comparisons. Those checks do not verify file contents, metadata completeness, hard links, extended attributes, access-control lists, sparse-file properties, or whether files changed while synchronization was running. The source remains writable during the copy and validation stages. A process can therefore modify, create, or delete files after `rsync` has copied them but before the original directory is removed. The subsequent `rm -rf` permanently deletes the authoritative source. The cutover is also insufficiently recoverable. Although shell short-circuiting prevents `ln` from running if `rm` fails, successful deletion followed by a failed symbolic-link creation leaves the expected path absent. No temporary backup or atomic rename is retained for rollback. ### Attack Path 1. A model service, training process, download process, or user continues writing to `~/models` during synchronization. 2. `rsync` copies an earlier state of one or more files to `/data/models`. 3. Aggregate sizes and file counts happen to match or appear sufficiently similar despite content or metadata differences. 4. The agent executes `rm -rf ~/models`, deleting the current authoritative data. 5. The symbolic link is ...[truncated 732 chars]
• Remediation: ## Remediation Suggestions - Stop or quiesce every process that can write to or hold a working directory inside the source. - Perform an initial copy followed by a final synchronization after writers are stopped. - Preserve relevant metadata by selecting appropriate `rsync` options, such as archive mode plus hard-link, ACL, and extended-attribute preservation where required. - Verify content with checksums rather than relying only on aggregate size and file counts. - Rename the source to a temporary backup instead of immediately deleting it. - Create the symbolic link, test application access, validate permissions, and perform a functional smoke test before deleting the backup. - Retain the backup for a defined rollback period. - Check that the destination filesystem supports all required metadata and has sufficient free space. - Abort the cutover if synchronization, verification, link creation, or application validation fails.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/home-partition-cleanup-case-20260829.md:22
• Finding: Broad Recursive Cache Deletion Can Remove Active User State Without Confirmation## Vulnerability Details **File Location**: `references/home-partition-cleanup-case-20260829.md`, lines 22-28 **Vulnerability Type**: Unguarded recursive deletion of user data **Risk Level**: Medium ```bash rm -rf ~/.cache/pip rm -rf ~/.npm/_cacache ~/.npm/_npx rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer rm -rf ~/.cache/mozilla ~/.cache/google-chrome rm -rf ~/.Trash/* ``` ### Technical Analysis These commands recursively and forcibly remove multiple directories without interactive confirmation, per-target inspection, process checks, or verification that the paths contain only disposable data. Package-manager caches are generally reconstructible, but deleting them can interrupt active builds and remove offline artifacts. Browser cache directories can also be in use by running processes and may contain recoverable application state. The commands appear in a historical case file, but the Skill references that case as operational guidance. An agent can therefore treat the examples as a general cleanup procedure even when the current host, user profile, directory layout, or application state differs from the documented case. Tilde expansion normally confines these paths to the current user's home directory, but running the procedure under the wrong account or through privileged automation changes the affected profile. Symbolic links, unusual directory layouts, and concurrent application writes further increase the chance of unintended deletion or inconsistent state. ### Attack Path 1. The agent identifies the user's home partition as nearly full. 2. It follows the documented first-round cleanup list without inspecting each current directory. 3. Browsers, package managers, or build tools are still running or relying on cached artifacts. 4. The agent executes the recursive deletion commands. 5. Active processes encounter missing or inconsistent files, and locally cached or recoverable state is per ...[truncated 687 chars]
• Remediation: ## Remediation Suggestions - Clearly label the commands as host-specific historical examples rather than a universal procedure. - Measure and display each target's size before deletion. - Resolve every path to its canonical location and reject unexpected symbolic links or paths outside the intended home directory. - Stop affected browsers, package managers, and build processes before cleanup. - Obtain explicit user approval for each deletion category, especially browser data and trash contents. - Prefer native cache-management commands where available. - Delete only verified cache contents instead of broad parent directories. - Perform a dry-run or candidate listing and report exactly what will be removed. - Avoid privileged execution for user-cache cleanup and verify the intended account before using home-relative paths.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (65)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

docker volume prune -f               # 悬空卷

# 2. 系统日志
sudo rm -f /var/log/messages-*       # 旧轮转文件（保留当前 messages，单份可 400-600M）
sudo journalctl --vacuum-size=300M   # 归档 journal（一次性）
# 持久化限制：
sudo mkdir -p /etc/systemd/journald.conf.d

• Confidence: 98% confidence
• Finding: `rm -f /var/log/messages-*` is a destructive wildcard command that can erase operational and security logs. In a triage skill, that creates real risk of evidence destruction, reduced observability, and accidental deletion if the filesystem layout differs from the author's assumptions.

Chaining Abuse

High

• Category: Tool Misuse

Content

sudo journalctl --vacuum-size=300M   # 归档 journal（一次性）
# 持久化限制：
sudo mkdir -p /etc/systemd/journald.conf.d
echo -e "[Journal]\nSystemMaxUse=300M" | sudo tee /etc/systemd/journald.conf.d/size.conf

# 3. /tmp 残留（确认无依赖再删；如安装包已装好则安装包可删）
sudo du -sh /tmp/* | sort -rh

• Confidence: 76% confidence
• Finding: The pipeline into `sudo tee` enables a privileged configuration write in one chained command, which is hazardous because it bypasses review of the exact file content and can be easily adapted to write arbitrary privileged configuration. In an agent skill, concise command chaining increases the chance of copy-paste execution without understanding side effects.

Credential Access

High

• Category: Privilege Escalation

Content

清理只是第一步，根治靠迁移 + 缓存重定向，否则缓存几个月又涨回去：
1. **清理**：按「可清理项清单」逐项回收（缓存/安装包残留/冗余模型/旧备份）
2. **大目录迁移**：~/models、项目目录等用 `rsync + 软链接` 迁到 /data（详见 `references/data-dir-migration-softlink-pattern.md`，含 venv/git 验证、权限坑、完整性校验）
3. **缓存重定向**：pip.conf / .npmrc / UV_CACHE_DIR 指向 /data/cache，防新增长；旧缓存手动删除回收
本机 2026-08-29 实测：/home 96% → 27%（清理回收 72G + models 65G + 项目 3.5G），方案可复制。

## Pitfalls

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 有 grep 到 inode 级引用（lsof 打开句柄）则不能迁；路径式引用软链接透明

# 2. /data 通常 root:root 755 → 先授权（本机 sudo 免密可用）
sudo mkdir -p /data/models && sudo chown <user>:<user> /data/models

# 3. 后台同步（大目录几十 G，用 background + notify_on_complete，别前台等）
rsync -a --info=progress2 ~/models/ /data/models/

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 有 grep 到 inode 级引用（lsof 打开句柄）则不能迁；路径式引用软链接透明

# 2. /data 通常 root:root 755 → 先授权（本机 sudo 免密可用）
sudo mkdir -p /data/models && sudo chown <user>:<user> /data/models

# 3. 后台同步（大目录几十 G，用 background + notify_on_complete，别前台等）
rsync -a --info=progress2 ~/models/ /data/models/

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 完成通知后核对：du -sh /data/models 与源大小一致、文件数一致

# 4. 验证后切换：删原目录 → 软链接
rm -rf ~/models && ln -s /data/models ~/models
ls -l ~/models          # 确认 -> /data/models
df -h /home /data       # 双分区复检
```

• Confidence: 90% confidence
• Finding: The broader matcher `rm -rf ~` is a static-analysis overmatch, but it still points to a true underlying risk because the command contains a recursive forced removal under the home directory. Even though the literal command targets `~/models`, the possibility of editing errors or malformed substitution makes this class of instruction dangerous.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 完成通知后核对：du -sh /data/models 与源大小一致、文件数一致

# 4. 验证后切换：删原目录 → 软链接
rm -rf ~/models && ln -s /data/models ~/models
ls -l ~/models          # 确认 -> /data/models
df -h /home /data       # 双分区复检
```

• Confidence: 90% confidence
• Finding: The broader matcher `rm -rf ~` is a static-analysis overmatch, but it still points to a true underlying risk because the command contains a recursive forced removal under the home directory. Even though the literal command targets `~/models`, the possibility of editing errors or malformed substitution makes this class of instruction dangerous.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 或 du -sh + find | wc -l 双侧对比；uv 缓存内 .git 空目录差异可忽略（内部结构）

# 2. 切换软链接：
rm -rf ~/quant-research && ln -s /data/quant-research ~/quant-research

# 3. 关键验证（不能省！）：
#    a) venv：/home/.../quant-research/.venv/bin/python --version

• Confidence: 90% confidence
• Finding: Similarly, the static tool matched a broader `rm -rf ~` pattern, but the real issue is the presence of an unsafe recursive deletion command within a user-home path. In a runbook-like skill, such commands should be treated as hazardous because slight path mistakes can have disproportionate impact.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 或 du -sh + find | wc -l 双侧对比；uv 缓存内 .git 空目录差异可忽略（内部结构）

# 2. 切换软链接：
rm -rf ~/quant-research && ln -s /data/quant-research ~/quant-research

# 3. 关键验证（不能省！）：
#    a) venv：/home/.../quant-research/.venv/bin/python --version

• Confidence: 90% confidence
• Finding: Similarly, the static tool matched a broader `rm -rf ~` pattern, but the real issue is the presence of an unsafe recursive deletion command within a user-home path. In a runbook-like skill, such commands should be treated as hazardous because slight path mistakes can have disproportionate impact.

Credential Access

High

• Category: Privilege Escalation

Content

sudo mkdir -p /data/cache/{pip,uv,npm} && sudo chown -R <user>:<user> /data/cache
mkdir -p ~/.config/pip
printf '[global]\ncache-dir = /data/cache/pip\n' > ~/.config/pip/pip.conf
printf 'cache=/data/cache/npm\n' > ~/.npmrc
echo 'export UV_CACHE_DIR=/data/cache/uv' >> ~/.bashrc
# 验证：
pip config get global.cache-dir    # 注意语法必须带 global. 前缀，否则报错

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

��重定向（防止 /home 缓存再次膨胀，一次性永久生效）
pip/npm/uv 缓存会持续增长（实测 pip 13.9G + uv 2.8G），迁移后必须重定向：

```bash
sudo mkdir -p /data/cache/{pip,uv,npm} && sudo chown -R <user>:<user> /data/cache
mkdir -p ~/.config/pip
printf '[global]\ncache-dir = /data/cache/pip\n' > ~/.config/pip/pip.conf
printf 'cache=/data/cache/npm\n' > ~/.npmrc
echo 'export UV_CACHE_DIR=/data/cache/uv' >> ~/.bashrc
# 验证：
pip config get global.cache-dir    # 注意语法必须带 global. 前缀，否则报错
npm config get cache
# uv 变量新终端生效；旧缓存目录可随后手动删除
```

## 坑（本案例实测）
1. **rsync 到 root 拥有的 /data 直接报 `mkdir "/data/models" failed: Permission denied (13)`**
   ——必须先 `sudo mkdir -p` + `sudo chown <user>:<user>` 再同步；建好的目录归用户所有，
   后续增量同步（rsync 重跑）无需再 sudo。
2. **软链接前的引用核查决定方案**：如果

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 清理项 | 释放 | 命令 |
|---|---|---|
| Docker 构建缓存 | 3.2G | `docker builder prune -f` |
| 系统日志旧轮转 | 2.0G | `sudo rm -f /var/log/messages-*`（4 份 465-575M） |
| journald 归档 | 1.2G | `sudo journalctl --vacuum-size=300M` |
| /tmp 残留 | 1.8G | ollama 安装包 1.4G + 临时提取目录/hm_test* |
| 无用镜像 | 0.1G | `docker rmi ai-device-manager:*`（先 `docker ps -a` 确认无容器引用） |

• Confidence: 94% confidence
• Finding: This duplicated finding points to the same risky construct: a root-level forced wildcard `rm` against system logs. Even if intended for disk cleanup, the pattern is dangerous because minor path/glob mistakes or unreviewed execution can destroy important data with no recovery path.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 清理项 | 释放 | 命令 |
|---|---|---|
| Docker 构建缓存 | 3.2G | `docker builder prune -f` |
| 系统日志旧轮转 | 2.0G | `sudo rm -f /var/log/messages-*`(4 份 465-575M) |
| journald 归档 | 1.2G | `sudo journalctl --vacuum-size=300M` |
| /tmp 残留 | 1.8G | ollama 安装包 1.4G + 临时提取目录/hm_test* |
| 无用镜像 | 0.1G | `docker rmi ai-device-manager:*`(先 `docker ps -a` 确认无容器引用) |

• Confidence: 94% confidence
• Finding: This duplicated finding points to the same risky construct: a root-level forced wildcard `rm` against system logs. Even if intended for disk cleanup, the pattern is dangerous because minor path/glob mistakes or unreviewed execution can destroy important data with no recovery path.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 第一轮：无争议缓存/垃圾（本案例回收 ≈53G）
| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |
| 回收站 | 1.3G | `rm -rf ~/.Trash/*` |

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 项 | 大小 | 命令 |
|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |
| 回收站 | 1.3G | `rm -rf ~/.Trash/*` |

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

|---|---|---|
| pip 缓存 | 13.9G | `rm -rf ~/.cache/pip` |
| npm 缓存 | 5.2G | `rm -rf ~/.npm/_cacache ~/.npm/_npx` |
| uv/yarn/go-build/puppeteer | 6G | `rm -rf ~/.cache/uv ~/.cache/yarn ~/.cache/go-build ~/.cache/puppeteer` |
| 浏览器缓存 | 1.1G | `rm -rf ~/.cache/mozilla ~/.cache/google-chrome` |
| 回收站 | 1.3G | `rm -rf ~/.Trash/*` |
| 已安装软件安装包 | 1.5G | `~/下载`、`~/Downloads` 下的 .deb/.rpm（Feishu/chrome/code/cursor 已装） |

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.