T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:50- Finding
Unverified Remote Binary Retrieval and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
mihomo-deploy-skill
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a legitimate Mihomo deployment guide, but it asks the agent to download and run mutable remote binaries and set up a persistent proxy service without enough integrity checks or network-exposure safeguards.
Install only if you are comfortable with the agent setting up a persistent proxy daemon in your user account. Prefer pinning Mihomo and Metacubexd to reviewed versions with checksums, keep the controller bound to 127.0.0.1 unless you have firewall controls and a strong secret, and review any changes to shell startup files and systemd user services.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/patch_config.py:50- Finding
YAML Configuration Injection Through Unescaped CLI Values
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a full deployment skill for mihomo plus the Metacubexd UI on Linux, including service setup behavior. The supplied code chunk is much narrower: it validates a config path, reads a YAML-like text file, replaces/appends a few top-level settings, optionally removes/sets a secret, and writes the file back. It performs configuration patching only, with no installation, download, service management, UI deployment, subscription handling, or server provisioning. That is a material mismatch in primary purpose and capabilities.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: mihomo-deploy description: Deploy mihomo proxy kernel + Metacubexd web UI on a Linux server (no sudo required, uses systemd --user). Use this skill whenever the user wants to set up mihomo, clash-meta, or a proxy service on a remote/local Linux server, or mentions deploying a proxy with a subscription config file, even if they don't explicitly say "mihomo deploy". --- # Mihomo Server Deployment
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md --- name: mihomo-deploy description: Deploy mihomo proxy kernel + Metacubexd web UI on a Linux server (no sudo required, uses systemd --user). Use this skill whenever the user wants to set up mihomo, clash-meta, or a proxy service on a remote/local Linux server, or mentions deploying a proxy with a subscription config file, even if they don't explicitly say "mihomo deploy". --- # Mihomo Server Deployment
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says to use this skill whenever the user wants to set up mihomo, clash-meta, or a proxy service, or even merely mentions deploying a proxy with a subscription config file. Those triggers are broad and lack exclusion conditions, which could cause the skill to be invoked for many generic proxy-related requests rather than this exact deployment scenario.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill offers binding the
external-controllerto0.0.0.0, which exposes the web UI/API to any network-reachable host, yet it does not strongly warn about the resulting remote attack surface. If combined with a weak, missing, or leaked secret, an attacker could remotely control the proxy service, inspect configuration, or pivot traffic through the host.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
If the architecture is anything else, stop and tell the user — unsupported architectures need manual handling.
Step 2: Create Directory Structure
bash mkdir -p ~/bin
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md cd ~/bin # Example for amd64 (substitute version and arch as needed): MIHOMO_VERSION=$(curl -s https://api.github.com/repos/MetaCubeX/mihomo/releases/latest | grep tag_name | cut -d '"' -f 4) ARCH="amd64" # change to arm64 or armv7 as detected curl -L -O "https://github.com/MetaCubeX/mihomo/releases/download/${MIHOMO_VERSION}/mihomo-linux-${ARCH}-compatible-${MIHOMO_VERSION}.gz"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
grep -q "^secret:" "$CONFIG" && sed -i "s/^secret:.*/secret: 'your-secret'/" "$CONFIG" || echo "secret: 'your-secret'" >> "$CONFIG"
text ## Step 7: Create systemd User Service Create `~/.config/systemd/user/mihomo.service`:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
By default, user services stop when you disconnect from SSH. To keep mihomo running after logout:
bash sudo loginctl enable-linger $USERIf the user doesn't have sudo, they should ask a sysadmin to run this for them, or accept that mihomo will only run during active SSH sessions.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash systemctl --user daemon-reload systemctl --user enable mihomo systemctl --user start mihomo
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description states the deployment uses systemd --user with 'no sudo required', suggesting an unprivileged setup. However, the documented workflow later instructs running 'sudo loginctl enable-linger $USER' to keep the service running after logout, which introduces a privileged operation as part of the deployment story.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The support summary explicitly says 'no sudo required (except optional linger)', but the manifest-level description omits that qualification and can be read as fully sudo-free deployment. The later step at L165-L173 instructs use of sudo for a feature tied to keeping the service running after logout, which creates a documentation-level inconsistency about the true requirements.
- Content
Static analysis
No suspicious patterns detected.