节点小宝管理

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:05 AM UTC
• Version: 1.0.0

Overview

The skill does manage the advertised JDxB remote-access service, but its installer gives unverified remote downloads persistent root-level execution.

Install only if you intentionally want this JDxB remote-access service on a trusted Linux host and are comfortable reviewing and verifying the installer yourself. Avoid the curl-to-sudo-bash one-liner, do not run install/update until the download source and archive integrity are verified, and understand that the service will run as root and persist across reboots.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/jdxb.sh:7
• Finding: Unverified remote payload is installed as a persistent root service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/jdxb.sh`, lines 7 and 141-197 **Vulnerability Type**: Unauthenticated remote code retrieval, privileged execution, and system persistence **Risk Level**: Critical ### Code Snippet ```bash BASE_URL="http://cdn.ionewu.com/upgrade/d" ``` ```bash local url="${BASE_URL}/${filename}" local workdir workdir=$(dirname "$INSTALL_DIR") cd "$workdir" if [[ ! -f "${filename}" ]]; then curl -fSL --progress-bar -O "${url}" || err "Download failed" fi tar -xzf "${filename}" || err "Extraction failed" local exec_script="${workdir}/${APP_NAME}/start.sh" [[ -f "$exec_script" ]] || err "start.sh was not found" chmod +x "$exec_script" cat > "$SERVICE_FILE" << EOF [Unit] Description=Owjdxb Service After=network.target Wants=network.target [Service] Type=oneshot User=root Group=root WorkingDirectory=${workdir}/${APP_NAME} ExecStart=${exec_script} RemainAfterExit=yes StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl enable "${APP_NAME}.service" systemctl restart "${APP_NAME}.service" ``` ### Technical Analysis The installer downloads an archive from a plaintext HTTP endpoint. It does not verify a cryptographic checksum, digital signature, trusted publisher identity, or pinned artifact digest before extracting and executing the downloaded content. The archive's `start.sh` is registered as the executable of a systemd service configured with `User=root` and `Group=root`. The service is enabled for `multi-user.target`, so the externally supplied payload runs immediately and persists across reboots. A systemd service is functionally consistent with managing an always-on remote-access product. However, automatically granting a mutable and unauthenticated remote payload persistent root execution exceeds minimum privilege. A dedicated unprivileged service account and a verified, immutable release artifact would be substantially safer. ### Atta ...[truncated 1067 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the HTTP source with an HTTPS endpoint controlled by the verified publisher. 2. Publish a SHA-256 or stronger digest through a separately authenticated channel and verify it before extraction. 3. Prefer signed release manifests or package signatures and validate the signing key against a pinned trusted key. 4. Download into a securely created temporary directory rather than a predictable or reusable path. 5. Abort installation if any signature or digest validation fails. 6. Run the service under a dedicated, non-login, unprivileged account instead of root. 7. Add systemd hardening such as `NoNewPrivileges=yes`, `PrivateTmp=yes`, `ProtectSystem=strict`, `ProtectHome=yes`, restricted writable paths, and capability restrictions. 8. Require explicit user confirmation before enabling boot persistence; installation and service enablement should be separate operations. 9. Prefer a packaged, auditable executable over an externally mutable startup script. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:32
• Finding: Documentation recommends piping a mutable remote script directly into a root shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32-34 **Vulnerability Type**: Direct remote script execution as root **Risk Level**: Critical ### Code Snippet ```bash curl -sL https://iepose.com/install.sh | sudo bash ``` ### Technical Analysis The documented installation command streams content from an external URL directly into a privileged shell. The user cannot inspect the final fetched content before execution, and the command does not pin a version, validate an artifact checksum, verify a digital signature, or authenticate a publisher key. Although HTTPS protects against some network interception, it does not protect against compromise of the domain, hosting account, origin server, deployment pipeline, or script itself. The effective root-level payload can change at any time after the Skill has been reviewed. ### Attack Path 1. An attacker compromises the remote domain, hosting infrastructure, deployment credentials, or installation script. 2. The attacker replaces `install.sh` with malicious shell code. 3. A user follows the installation instructions. 4. `curl` streams the modified script into `sudo bash`. 5. The malicious commands execute immediately with root privileges without a local review or integrity check. ### Impact Assessment The remote script receives unrestricted root-level command execution. It can modify any system file, extract credentials, install services or scheduled tasks, disable security controls, deploy malware, and establish persistent remote access. The impact covers the entire host and all data accessible to root. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Remove the pipe-to-shell installation command. Replace it with a process that: 1. Downloads a versioned release artifact to a local file. 2. Verifies a publisher signature and a cryptographic checksum from an authenticated source. 3. Allows the user to inspect the script or package before execution. 4. Executes only the verified artifact. 5. Uses privilege elevation only for the installation steps that require it. 6. Documents the expected signing key fingerprint and exact release version. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/jdxb.sh:154
• Finding: Remote archive is extracted as root without validating paths or link targets<![CDATA[ ## Vulnerability Details **File Location**: `scripts/jdxb.sh`, lines 154-163 **Vulnerability Type**: Unsafe privileged archive extraction **Risk Level**: High ### Code Snippet ```bash if [[ -d "${APP_NAME}" ]]; then rm -rf "${APP_NAME}" fi tar -xzf "${filename}" || err "Extraction failed" local exec_script="${workdir}/${APP_NAME}/start.sh" [[ -f "$exec_script" ]] || err "start.sh was not found" chmod +x "$exec_script" ``` ### Technical Analysis The installer runs as root and extracts a remotely supplied tar archive without first validating archive member names or link targets. There are no checks for absolute paths, `..` traversal components, device files, or symbolic and hard links that resolve outside the intended installation directory. Depending on the `tar` implementation and archive construction, a malicious archive may write outside the expected application directory or exploit links to overwrite privileged files. This creates an independent privileged file-write risk before the extracted `start.sh` is executed. ### Attack Path 1. An attacker supplies a crafted archive through the vulnerable download channel or cached-file mechanism. 2. The archive contains traversal entries, escaping links, or other unsafe members. 3. A root user invokes installation or update. 4. `tar -xzf` extracts the malicious members without prior validation. 5. Files outside the intended installation directory are created or overwritten. 6. The overwritten file is subsequently loaded by the operating system, a privileged service, or a user, resulting in persistence, code execution, or system corruption. ### Impact Assessment Potential impact includes arbitrary root-owned file creation or overwrite, system configuration modification, persistent code execution, replacement of service files or executables, and denial of service. The exact outcome depends on the archive format, local `tar` behavior, and targeted paths, but extraction occurs with root privileges ...[truncated 43 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Verify the archive's trusted digital signature before processing it. 2. List and validate every archive member before extraction. 3. Reject absolute paths, parent-directory components, device nodes, and unsafe symbolic or hard links. 4. Extract into a newly created directory with restrictive permissions. 5. Perform extraction under an unprivileged account. 6. Use archive options that prevent ownership restoration and reduce link-related risks. 7. Confirm that the canonical path of every extracted file remains inside the intended installation directory. 8. Move verified files into their final destination atomically only after validation succeeds. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/jdxb.sh:148
• Finding: Update operation trusts a pre-existing archive without integrity verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/jdxb.sh`, lines 148-153 and 215-217 **Vulnerability Type**: Local artifact substitution during privileged update **Risk Level**: Medium ### Code Snippet ```bash if [[ ! -f "${filename}" ]]; then curl -fSL --progress-bar -O "${url}" || err "Download failed" else ok "File exists, skipping download" fi ``` ```bash update_cmd() { install_cmd } ``` ### Technical Analysis The update command calls the installation routine. If an archive with the expected filename already exists in the working directory, the script skips downloading it and trusts the existing file without checking its owner, permissions, checksum, signature, or origin. Because installation and update require root, an attacker who can place or replace that archive before an administrator runs the command can cause attacker-controlled content to be extracted and executed through the root systemd service. Reusing the cached file also prevents the installer from obtaining corrected upstream content when the version filename remains unchanged. ### Attack Path 1. An attacker gains write access to the archive location or causes a malicious file with the expected release filename to be placed there. 2. An administrator invokes `jdxb.sh update` as root. 3. `update_cmd` calls `install_cmd`. 4. The installer detects the existing filename and skips the network download. 5. No signature, digest, ownership, or permission validation occurs. 6. The malicious archive is extracted. 7. Its `start.sh` is installed and executed through the root systemd service. ### Impact Assessment Where an attacker can control the cached archive, exploitation escalates that file-placement capability to arbitrary root code execution and boot persistence. The scope includes all host files, credentials, services, and network resources accessible to root. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never implicitly trust a pre-existing release archive. 2. Download each update into a securely created temporary file using exclusive creation. 3. Verify a pinned digest or trusted publisher signature regardless of whether the artifact is cached. 4. Validate file ownership and permissions before use. 5. Reject files writable by untrusted users or groups. 6. Use versioned immutable artifacts and atomic replacement. 7. Remove temporary archives after successful installation. 8. Separate update download, verification, installation, and service restart into explicit failure-safe stages. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The markdown recommends a remote one-liner that downloads and executes a script as root without any warning about the trust, integrity, or review implications. This is dangerous because it enables immediate privileged code execution from a network source, creating a direct path for compromise if the server, DNS, TLS trust, or script contents are malicious or altered.

External Script Fetching

High

• Category: Supply Chain

Content

Or use the official one-liner:

```bash
curl -sL https://iepose.com/install.sh | sudo bash
```

## Service Details

• Confidence: 99% confidence
• Finding: Fetching an external script from the internet and executing it directly is a classic unsafe pattern because it trusts mutable remote content at runtime. Here the danger is amplified by piping it into sudo bash, which grants full system compromise if the content or delivery path is malicious.

Chaining Abuse

High

• Category: Tool Misuse

Content

Or use the official one-liner:

```bash
curl -sL https://iepose.com/install.sh | sudo bash
```

## Service Details

• Confidence: 98% confidence
• Finding: The shell pipeline chains network retrieval directly into privileged execution, removing opportunities for inspection, validation, and user review. This makes abuse easy and detection hard, and it can convert a single compromised endpoint or typo-squatted domain into full root-level execution on the target system.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises shell-based operational capabilities but does not declare any tool scope or permission boundaries. That increases the chance an agent may invoke shell actions without clear authorization constraints, especially for install, update, and uninstall flows involving system changes.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: jdxb
description: Manage 节点小宝 (Node Baby Link / JDxB) remote access service on Linux. Install, start/stop/restart the systemd service, check status, view logs, get pairing codes, update, and uninstall. Triggers on mentions of 节点小宝, jdxb, node baby link, remote access proxy, or port 9118.
---

# 节点小宝 (JDxB) Management

• Confidence: 88% confidence
• Finding: The skill is specifically designed to install and manage a systemd-based remote access service, which creates persistence across reboots and exposes ongoing remote-control functionality. In this context, persistence is inherently sensitive because misuse can establish or maintain unauthorized access on the host.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is broad and includes generic terms like remote access proxy and a port number, which can cause unintended invocation in unrelated conversations. Because this skill manages a persistent remote-access service and includes privileged install paths, accidental activation increases operational and security risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The uninstall command is presented without warning that it stops a service and removes installed files. In an agent context, this can lead to destructive actions being taken without the user's informed consent, especially if the skill is triggered unintentionally.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Requires root. First-time install:

```bash
sudo bash skills/jdxb/scripts/jdxb.sh install
```

Or use the official one-liner:

• Confidence: 80% confidence
• Finding: The skill instructs users to run the bundled installer with sudo, which elevates execution to root and allows system-wide changes. While administrative installation may legitimately require privilege, presenting privileged execution without strong guardrails increases the risk of misuse or accidental host modification.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Or use the official one-liner:

```bash
curl -sL https://iepose.com/install.sh | sudo bash
```

## Service Details

• Confidence: 97% confidence
• Finding: This command combines root execution with a remotely fetched script, so any compromise of the remote source results in immediate privileged code execution. The risk is substantially higher than ordinary sudo usage because the code being executed is not pinned, reviewed, or verified locally first.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script downloads an executable package from a plain HTTP URL and then installs and runs it as root via systemd. Because HTTP provides no transport integrity or authenticity, any man-in-the-middle or compromised network path could replace the archive with malicious code and gain persistent root-level execution on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

EOF
    
    systemctl daemon-reload
    systemctl enable "${APP_NAME}.service"
    
    info "🚀 启动服务..."
    systemctl restart "${APP_NAME}.service"

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The uninstall routine removes the systemd service file and recursively deletes the installation directory with rm -rf, which is destructive and irreversible. Although the script prints a success message afterward, it does not warn the user beforehand or ask for confirmation before deleting files.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The script's user-facing usage and status/error messages are written entirely in Chinese, with no indication that language is configurable or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a locale without offering user choice or documenting a justified restriction.

Static analysis

No suspicious patterns detected.