Security audit

模型蒸馏大师

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible model-distillation workflow, but it asks agents to install software, download models, run training, and trust remote model code with weak approval and scoping controls.

Review this skill before installing. Use it only in an isolated virtual environment or container, pin dependencies and model revisions, disable trust_remote_code unless you have reviewed the model repository, and require explicit approval before downloads, package installs, teacher API calls, training, or generated script execution. Do not use sensitive or regulated datasets with remote teacher APIs unless you have confirmed provider privacy and retention terms.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/distill_train.py:261
Finding: Arbitrary Code Execution Through Trusted Remote Model Code
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup_env.sh:40
Finding: Automatic Installation of Unpinned Python and System Dependencies
Content: View full analysis
/dev/null; then if [[ "$OSTYPE" == "linux-gnu"* ]]; then apt-get update && apt-get install -y git-lfs 2>/dev/null || echo "Install git-lfs manually" elif [[ "$OSTYPE" == "darwin"* ]]; then brew install git-lfs 2>/dev/null || echo "Install git-lfs manually" fi fi ``` The primary Skill instructions direct the Agent to install dependencies and clone the model immediately without waiting for confirmation: ```bash pip install transformers torch datasets accelerate bitsandbytes peft unsloth -q if [ ! -d "./models/gemma-3-4b-it" ]; then git lfs install git clone https://www.modelscope.cn/LLM-Research/gemma-3-4b-it.git ./models/gemma-3-4b-it fi ``` ### Technical Analysis None of the Python dependencies are pinned to exact versions or verified using package hashes. This causes each installation to resolve whichever versions and transitive dependencies are current at execution time. Machine-learning packages have large dependency graphs and may execute installation or import-time code. A compromised upstream release, dependency-confusion event, malicious transitive package, or incompatible future version could therefore affect the host without any change to the reviewed Skill package. The same setup process can invoke `apt-get` or Homebrew. Depending on how the Agent is ...[truncated 1690 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/package_deployment.py:94
Finding: Shell Command Injection in Generated GGUF Conversion Script
Content: View full analysis
str: output_dir = Path(output_path) output_dir.mkdir(parents=True, exist_ok=True) convert_script = f"""#!/bin/bash # GGUF conversion script LLAMA_CPP_PATH=${{LLAMA_CPP_PATH:-"./llama.cpp"}} python $LLAMA_CPP_PATH/convert_hf_to_gguf.py \ {model_path} \ --outfile {output_dir}/{self.config.model_name}.gguf \ --outtype {self.config.quantization or "f16"} echo "Conversion completed: {output_dir}/{self.config.model_name}.gguf" """ with open(output_dir / "convert_to_gguf.sh", 'w') as f: f.write(convert_script) ``` The interpolated values are derived from command-line arguments: ```python parser.add_argument("--model-path", required=True, help="Model path") parser.add_argument("--output", default="outputs/deploy", help="Output directory") parser.add_argument("--format", default="hf", choices=["hf", "gguf", "onnx"]) parser.add_argument("--quant", choices=["int8", "int4", "f16"]) parser.add_argument("--name", default="distilled_model", help="Model name") parser.add_argument("--version", default="1.0.0", help="Version") args = parser.parse_args() config = DeploymentConfig( model_name=args.name, version=args.version, format=args.format, quantization=args.quant, max_batch_size=1, max_seq_length=8192 ) packager = DeploymentPackager(config) output_path = f"{args.output}/{args.name}" packager.package(args.model_path, output_path) ``` ### Technical Analysis `model_path`, `output_dir`, and `model_name` are inserted directly into Bash source without quoting or validation. Shell metacharacters, command substitutions, newlines, and argument separator ...[truncated 1834 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (69)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README instructs users to generate CoT data using a remote teacher model (gpt-4) without warning that prompts and possibly sensitive source data will be transmitted to an external API provider. In a distillation workflow, training inputs may contain proprietary, regulated, or confidential material, so silent exfiltration to a third party creates a meaningful confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个完整的模型蒸馏与压缩系统，核心能力应包括教师模型与学生模型之间的训练/迁移、蒸馏策略、训练过程控制以及评估。实际代码只是一个 baseline_test.py：加载单个模型，生成几个固定测试用例的回答，检查关键词，计算 token 生成速度，并将结果写入报告。这属于基础能力评测/基线测试，最多可作为蒸馏前后的辅助评估环节，但并不能代表“模型蒸馏大师”的主要功能。代码没有训练、蒸馏、比较教师与学生、处理课程学习或对抗训练等行为，因此描述与实际行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: 总体上，代码的主目的与“模型蒸馏训练”这一大方向是匹配的，且确实实现了自适应蒸馏这一核心能力，因此不是完全无关的描述。但声明明显夸大了能力范围：代码没有课程学习、能力感知、对抗训练、多维度评估等完整工作流实现，更多是一个自适应KD + LoRA/QLoRA 的训练脚本。另外，默认学生模型的声明也与代码不一致，代码实际不固定学生模型，而是从配置读取，并在文件头中特别说明针对 gemma-4-E4B-it 优化。因此应判定为描述与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个高层次、功能完整的模型蒸馏工具，但提供的代码片段只是一个模型下载器。其主要目的与声明严重不符：代码只访问外部模型仓库下载预训练模型，没有任何训练数据处理、教师-学生框架、损失函数设计、蒸馏策略、评估流程或对抗训练实现。此外，声明中的默认学生模型与代码实际下载的模型名称也不一致。因此这是明显的描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个完整的模型蒸馏工作流工具，核心应包含训练/蒸馏逻辑、教师学生模型处理、评估等能力。而提供的代码仅执行模型下载准备工作：创建目录、检测并尝试安装 git-lfs、克隆指定模型仓库、检查文件完整性。虽然下载默认学生模型可被视为蒸馏前的辅助步骤，但该代码片段的实际主功能与声明的核心能力明显不符，且完全缺少任何蒸馏、训练或评估实现，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明描述的是一个“模型蒸馏大师”型技能，重点应在教师-学生迁移、训练策略和完整蒸馏工作流。给出的代码却只实现了评估环节，且评估方法相对简单：生成回答、做字符串匹配、统计tokens/s，并可对比基线模型与蒸馏后模型。虽然这与“蒸馏前后性能差异评估”相关，算是蒸馏工作流中的辅助部分，但远不足以支撑声明中的主要能力与完整流程。因此代码实际行为与声明用途存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个范围很广的“模型蒸馏大师”工作流，应至少涉及教师/学生模型迁移、蒸馏训练或相关评估能力。但提供的代码片段只负责生成CoT（思维链）训练数据，属于蒸馏数据准备阶段的一个辅助脚本，而且实际教师模型调用都还是模板/模拟实现。该代码的主要用途与声明的完整蒸馏系统存在明显差异。虽然CoT数据生成可作为蒸馏流程的支持环节，但单独这段代码不足以支撑所宣称的核心能力，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个覆盖蒸馏训练、策略与评估的完整系统，而提供的代码片段只做蒸馏后可能用到的一个辅助步骤：把LoRA权重合并到基础模型以便部署。虽然注释提到“蒸馏完成后”使用，但代码本身不执行蒸馏、不分析教师模型、不处理学生模型选择，也不包含训练、评估或课程/对抗等机制。因此代码的实际主要目的与声明的主要用途存在明显偏差，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个覆盖蒸馏建模全流程的能力型技能，重点在训练、分析和评估；而提供的代码块是独立的部署阶段脚本，主要做模型文件复制、生成 deployment_config.json、推理示例、requirements、README，并创建 zip/tar.gz 包，以及生成 GGUF/ONNX 转换脚本。虽然注释中称对象为“蒸馏模型”，但代码并不参与蒸馏本身，只处理已有模型的部署封装。这属于主要用途显著不同，并且存在未声明但明显的部署/转换能力，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states that the workflow will automatically download a model, create project structure, and run baseline tests, but it does not clearly warn users about network access, significant disk consumption, or filesystem modifications. In an agent skill context, users may trigger these actions expecting advisory behavior, which can lead to unexpected resource use and side effects on the local machine.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs shell execution, file creation, package installation, and repository cloning, but declares no explicit tool/permission scope. This creates an ambient-authority problem where an agent may perform filesystem and shell actions without transparent user-approved boundaries, increasing the chance of unsafe execution or overreach.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to immediately mutate the local environment by installing packages, enabling git-lfs, cloning a remote model repository, and creating directories before obtaining user confirmation. In a skill context, autonomous pre-confirmation execution is dangerous because it can unexpectedly alter the host, consume resources, and import untrusted external artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs immediate package installation, repository cloning, and filesystem modification without an explicit warning or consent gate. This is dangerous because executing setup commands can change the runtime, install unreviewed dependencies, consume storage/bandwidth, and increase supply-chain risk from remote packages or repositories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow tells the agent to call external teacher-model APIs and collect data without warning that prompts, datasets, or proprietary inputs may be transmitted to third-party services. In a distillation workflow, this context makes the risk more significant because training data often contains sensitive or licensed material that should not be sent externally by default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Earlier description lines advertise a '完整工作流' supporting adaptive distillation, curriculum learning, capability awareness, adversarial training, and multidimensional evaluation. The component inventory names corresponding scripts such as generate_curriculum_data.py, generate_adversarial_samples.py, capability_aware_distill.py, and package_deployment.py, but this file only actually specifies generation of distill_train.py and evaluate.py, with no implementation details for the other claimed modules.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The component table says scripts/distill_train.py provides '动态温度/alpha调度' (dynamic temperature/alpha scheduling). In the actual script, temperature and alpha are read once from config and used as constants in loss computation, with no scheduling or adaptation logic, so the documentation overstates what the code does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This plain-text sample file presents all instructional text and examples exclusively in Chinese, with no indication that the locale is optional or that the dataset is intentionally region-specific. Under the policy rule for natural-language violations, a forced language choice without user opt-in or justification is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: 文件的名称、说明和触发词均以中文固定表述，未声明支持其他语言或允许用户选择语言/区域设置。根据语言/locale 政策，若技能对输出或交互语言施加固定约束而无用户 opt-in，属于自然语言策略问题。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrases include broad terms such as “用 LangGraph 蒸馏” and “智能蒸馏流程”, which can match ambiguous user requests and cause the skill to activate outside the user’s intended scope. In a skill that can generate data, run training, and produce artifacts, accidental activation increases the chance of unintended resource consumption or workflow initiation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document describes synthesizing training data, executing training, saving checkpoints, and delivering a model, but it does not clearly warn users that these actions can write files, consume compute, and create durable artifacts. In practice, this can mislead users into invoking a workflow with side effects they did not fully consent to, especially when resumable execution and retries are built in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s natural-language descriptions and all user-facing prompts are written in Chinese, indicating the workflow is designed to operate in a single language. There is no visible opt-in, fallback, or documented locale constraint justifying why users must interact in Chinese.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The human_confirm node is documented as a human-in-the-loop approval gate, but it unconditionally sets user_approved=True and proceeds. This defeats an expected safety/control checkpoint, allowing the workflow to continue with data generation, training, and delivery even when a user should have had the opportunity to stop or modify execution.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring, function docstring, domain labels, and recommendations are all hard-coded in Chinese. This creates a language-policy concern because the skill imposes a specific language/locale on users without any opt-in mechanism or explanation that it is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/distill_train.py:212

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/evaluate.py:29