K10 Compile Server

• Outcome: Review
• Latest audit: Jul 22, 2026 · 8:32 AM UTC
• Version: 1.0.3

Overview

The skill is purpose-aligned, but it sends projects to a compile server and downloads or flashes firmware while disabling certificate checks, so it needs user review before installation.

Install only if you control or strongly trust the K10 compile server and network path. Avoid using this with public or unknown servers, do not put secrets in projects you upload, prefer a real trusted certificate or VPN/tunnel, and review any downloaded firmware before flashing where possible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The troubleshooting guide includes `rm -rf` cleanup commands that can permanently delete cached packages and temporary build directories, but it does not warn users about the data loss, rebuild cost, or the need to verify the target paths before running them. In a support document, destructive commands without explicit caution increase the chance of accidental system damage or unnecessary loss of cached tooling.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The document explicitly advises users to bypass browser HTTPS certificate warnings, including Chrome's `thisisunsafe` override, without a strong warning about man-in-the-middle risk or limiting this to a controlled local environment. This normalizes unsafe TLS behavior and can train users to ignore certificate errors in more dangerous contexts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: `esptool.py erase_flash` irreversibly wipes the device flash, but the guide presents it as a simple troubleshooting step without warning that it destroys existing firmware and stored contents. Users may erase a working device or lose custom data while attempting recovery.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The temporary workaround `sudo chmod 666 /dev/ttyUSB0` makes the serial device world-writable, allowing any local user or process to access and manipulate the attached hardware. Presenting this without a security warning encourages an overly permissive fix that can expose the device to unintended access on multi-user systems.

External Script Fetching

High

• Category: Supply Chain

Content

# ── Step 3: Submit compile ────────────────────────────────────

echo "🚀 Submitting compile job..."
SUBMIT=$(curl -skf -X POST "$SERVER/api/compile" \
  -F "file=@$ZIP_FILE" 2>/dev/null)

BUILD_ID=$(echo "$SUBMIT" | python3 -c "import sys,json;print(json.load(sys.stdin)['build_id'])" 2>/dev/null || echo "")

• Confidence: 94% confidence
• Finding: The script uploads a project archive to a user-supplied remote server using curl with '-k', which disables TLS certificate validation. In this skill's context, the archive may contain proprietary source code, secrets, or build metadata, so a machine-in-the-middle or malicious server can intercept or tamper with the uploaded project and return untrusted build artifacts.

External Script Fetching

High

• Category: Supply Chain

Content

fi

echo "💾 Downloading firmware to $OUTPUT"
if ! curl -skf -o "$OUTPUT" "$SERVER/api/build/$BUILD_ID/download" 2>/dev/null; then
  echo "❌ Firmware download failed"
  exit 1
fi

• Confidence: 96% confidence
• Finding: The script downloads firmware from a remote server over HTTPS while explicitly skipping certificate validation via '-k', then treats the result as the build output. In this skill, that is especially dangerous because the downloaded binary may later be flashed to hardware, enabling malicious firmware delivery through server compromise or network interception.

External Script Fetching

High

• Category: Supply Chain

Content

trap "rm -f $ZIP_FILE; rm -rf $FLASH_DIR" EXIT
  echo "⬇️  Downloading flash files for local upload..."
  for FILE in bootloader partitions firmware; do
    if ! curl -skf -o "$FLASH_DIR/${FILE}.bin" "$SERVER/api/build/$BUILD_ID/file/${FILE}.bin" 2>/dev/null; then
      echo "❌ Failed to download ${FILE}.bin"
      exit 1
    fi

• Confidence: 97% confidence
• Finding: The script downloads multiple flash components (bootloader, partitions, firmware) from the remote server with certificate checks disabled and then uses them for local device flashing. Because these binaries are directly written to the target device, tampering could fully compromise the hardware and any downstream systems interacting with it.

Static analysis

No suspicious patterns detected.