ClawHub
Back to skill

Security audit

Trojan Setup

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real Trojan proxy setup skill, but it needs Review because it asks for root access and makes broad system, network, and package-source changes with unsafe defaults.

Install only on a machine where you are comfortable granting root access to a proxy installer. Review install.sh first, verify the Trojan release and Google key yourself, avoid disabling TLS verification unless you understand the risk, bind the local proxy to 127.0.0.1 unless LAN access is intended, protect the Trojan password in config.json, and enable autostart only if you want the proxy running after every reboot.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly directs users to execute shell commands and a privileged install script, yet the skill metadata shown in this file does not declare corresponding permissions or capabilities. This weakens transparency and reviewability, making it easier for high-impact system changes to be hidden behind undocumented shell execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The description presents the skill as a proxy setup helper, but the documented behavior also includes modifying apt sources, importing GPG keys, updating package indexes, and installing additional software. That mismatch is dangerous because users may consent to proxy configuration without realizing broader trust-store and package-management changes will occur.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script changes global APT repository configuration for Google Chrome even though the stated skill purpose is installing Trojan and proxychains4. This expands system trust and package sources beyond the declared scope, increasing supply-chain and configuration risk on a root-executed installer.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The markdown instructs the user to run sudo ./install.sh without first describing the script's contents or expected system changes. Running an opaque privileged script materially increases the risk of unintended or malicious system modification, especially in a networking/proxy setup context that already alters connectivity and trust boundaries.

Missing User Warnings

High
Confidence
98% confidence
Finding
The sample configuration disables both TLS certificate validation and hostname verification with "verify": false and "verify_hostname": false, but the surrounding documentation does not warn users that this permits man-in-the-middle interception. In a censorship-circumvention/proxy tool, disabling transport verification directly undermines the confidentiality and integrity the tool is supposed to provide.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The uninstall section includes privileged deletion commands affecting /usr/src/trojan and a systemd unit file, but gives no warning to review paths or understand data loss implications. Even if the shown paths are specific, normalizing blind use of sudo rm commands increases the risk of operator error and destructive copy/paste mistakes.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
## 前置条件

- Linux 系统（Ubuntu/Debian 等）
- sudo 权限
- Trojan 服务器信息（IP、端口、密码、SNI）

## 安装步骤
Confidence
84% confidence
Finding
Requiring sudo/root for installation and system configuration is expected for package installation, service management, and repository changes, but it still expands blast radius if the commands or script are wrong. In this skill's context, elevated privileges are especially sensitive because the operations affect networking, package sources, and persistence.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo systemctl disable trojan

# 删除文件
sudo rm -rf /usr/src/trojan
sudo rm -f /etc/systemd/system/trojan.service

# 删除 proxychains4
Confidence
87% confidence
Finding
This section instructs users to run privileged file-deletion commands during uninstall. While removal often requires root, combining sudo with recursive deletion in documentation raises the risk of catastrophic mistakes if paths are edited, templated, or copied incorrectly.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# 删除文件
sudo rm -rf /usr/src/trojan
sudo rm -f /etc/systemd/system/trojan.service

# 删除 proxychains4
sudo apt remove proxychains4
Confidence
86% confidence
Finding
Deleting a systemd unit file with sudo is a privileged destructive action and should be treated carefully. In isolation it may be legitimate for uninstall, but the documentation does not require users to confirm the file belongs to this skill or explain the effect on service management.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
sudo systemctl start trojan
sudo systemctl enable trojan  # 开机自启
```

### 4. 验证代理
Confidence
88% confidence
Finding
Enabling the trojan service at boot establishes persistence on the host. Persistence is not automatically malicious here, but it is security-relevant because it ensures a network proxy starts automatically on every reboot, potentially affecting traffic routing and host exposure long-term.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README.md:136

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:192