Clashx Node Switcher

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent ClashX automation guide, but it asks the agent to take full-screen screenshots into predictable temporary files without privacy handling.

Review this skill before installing. It appears intended to automate ClashX node selection, but only use it when unrelated private windows or notifications are hidden, and prefer changing the screenshot steps to capture only the ClashX menu into a private temporary directory with immediate cleanup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:35

Finding

Full-Screen Captures Are Written to Predictable Temporary Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35 and 74
Vulnerability Type: Unsafe temporary-file handling and excessive screen capture
Risk Level: Medium

Vulnerable code snippets:

bash

screencapture -x /tmp/clash_nodes.png

bash

screencapture -x /tmp/screen.png

Technical Analysis

The documented commands capture the entire display even though the workflow only requires information from the ClashX menu. A full-screen image can include unrelated sensitive content, such as notifications, account information, messages, application windows, or confidential documents.

Both images are written under fixed, predictable names in the shared /tmp directory. The workflow does not create a private temporary directory, verify the destination file, enforce restrictive permissions, or delete the screenshots after use. Predictable temporary paths may permit another local process or user to monitor the generated files. They may also create file-clobbering or symbolic-link risks where the operating system's temporary-file protections do not prevent such attacks.

Attack Path

1. An attacker with local access monitors /tmp/clash_nodes.png and /tmp/screen.png, or prepares one of those paths as a symbolic link where platform protections permit it.
2. The user follows the Skill workflow while unrelated sensitive information is visible on the display.
3. screencapture records the complete screen and writes the image to the predictable path.
4. The attacker reads the retained screenshot or, in a file-replacement scenario, causes the command to overwrite a target writable by the user.
5. Because no cleanup step is specified, the screenshot can remain available after the workflow finishes.

Impact Assessment

The primary impact is disclosure of any information visible on the user's screen at capture time. Exposure is limited to parties or processes capable of accessing the resulting ...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

• Capture only the ClashX menu or the smallest required screen region rather than the entire display.
• Create a private temporary directory with mktemp -d and restrictive permissions instead of using fixed names directly under /tmp.
• Generate unpredictable filenames and verify that destinations are regular files rather than symbolic links.
• Set a restrictive process umask, such as umask 077, before creating screenshots.
• Remove captured images immediately after processing and add cleanup through a shell trap so files are deleted on both success and failure.
• Avoid retaining screenshots unless they are strictly necessary. If retention is required, store them in an access-controlled location and document the retention period.
• A hardened pattern is:

bash

umask 077
tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/clashx-scan.XXXXXX")" || exit 1
trap 'rm -rf "$tmp_dir"' EXIT

# Capture only the required region; replace x,y,w,h with validated values.
screencapture -x -R"x,y,w,h" "$tmp_dir/clash_nodes.png"

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

sleep 3 # Wait for test to complete

text

### 3. Wait for Results Dialog
The dialog shows "延迟测速完成" (Latency test complete). Capture screenshot to see results.

### 4. Dismiss Results and See Node List

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs taking a screenshot to inspect UI state without any warning that on-screen content may include sensitive information such as messages, credentials, browser tabs, or other unrelated application data. Because this is a GUI automation skill operating on the full desktop, even a seemingly narrow screenshot can capture more context than intended and expose private data to logs, storage, or downstream processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The debugging section instructs capturing the full screen and saving it to /tmp without any privacy notice or handling guidance. Full-screen captures are especially risky because they can include unrelated applications, notifications, secrets, and personal data, increasing the chance of unintended disclosure during troubleshooting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.