节点小宝管理

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:05 AM UTC
• Version: 1.0.0

Overview

The skill does manage the advertised JDxB remote-access service, but its installer gives unverified remote downloads persistent root-level execution.

Install only if you intentionally want this JDxB remote-access service on a trusted Linux host and are comfortable reviewing and verifying the installer yourself. Avoid the curl-to-sudo-bash one-liner, do not run install/update until the download source and archive integrity are verified, and understand that the service will run as root and persist across reboots.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/jdxb.sh:7

Finding

Unverified remote payload is installed as a persistent root service

Content

View full analysis

"$SERVICE_FILE" << EOF [Unit] Description=Owjdxb Service After=network.target Wants=network.target [Service] Type=oneshot User=root Group=root WorkingDirectory=${workdir}/${APP_NAME} ExecStart=${exec_script} RemainAfterExit=yes StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl enable "${APP_NAME}.service" systemctl restart "${APP_NAME}.service" ``` ### Technical Analysis The installer downloads an archive from a plaintext HTTP endpoint. It does not verify a cryptographic checksum, digital signature, trusted publisher identity, or pinned artifact digest before extracting and executing the downloaded content. The archive's `start.sh` is registered as the executable of a systemd service configured with `User=root` and `Group=root`. The service is enabled for `multi-user.target`, so the externally supplied payload runs immediately and persists across reboots. A systemd service is functionally consistent with managing an always-on remote-access product. However, automatically granting a mutable and unauthenticated remote payload persistent root execution exceeds minimum privilege. A dedicated unprivileged service account and a verified, immutable release artifact would be substantially safer. ### Atta ...[truncated 1067 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:32

Finding

Documentation recommends piping a mutable remote script directly into a root shell

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/jdxb.sh:154

Finding

Remote archive is extracted as root without validating paths or link targets

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/jdxb.sh:148

Finding

Update operation trusts a pre-existing archive without integrity verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The markdown recommends a remote one-liner that downloads and executes a script as root without any warning about the trust, integrity, or review implications. This is dangerous because it enables immediate privileged code execution from a network source, creating a direct path for compromise if the server, DNS, TLS trust, or script contents are malicious or altered.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching an external script from the internet and executing it directly is a classic unsafe pattern because it trusts mutable remote content at runtime. Here the danger is amplified by piping it into sudo bash, which grants full system compromise if the content or delivery path is malicious.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Or use the official one-liner:

bash

curl -sL https://iepose.com/install.sh | sudo bash

Service Details

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The shell pipeline chains network retrieval directly into privileged execution, removing opportunities for inspection, validation, and user review. This makes abuse easy and detection hard, and it can convert a single compromised endpoint or typo-squatted domain into full root-level execution on the target system.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Or use the official one-liner:

bash

curl -sL https://iepose.com/install.sh | sudo bash

Service Details

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises shell-based operational capabilities but does not declare any tool scope or permission boundaries. That increases the chance an agent may invoke shell actions without clear authorization constraints, especially for install, update, and uninstall flows involving system changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill is specifically designed to install and manage a systemd-based remote access service, which creates persistence across reboots and exposes ongoing remote-control functionality. In this context, persistence is inherently sensitive because misuse can establish or maintain unauthorized access on the host.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: jdxb
description: Manage 节点小宝 (Node Baby Link / JDxB) remote access service on Linux. Install, start/stop/restart the systemd service, check status, view logs, get pairing codes, update, and uninstall. Triggers on mentions of 节点小宝, jdxb, node baby link, remote access proxy, or port 9118.
---

# 节点小宝 (JDxB) Management

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is broad and includes generic terms like remote access proxy and a port number, which can cause unintended invocation in unrelated conversations. Because this skill manages a persistent remote-access service and includes privileged install paths, accidental activation increases operational and security risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The uninstall command is presented without warning that it stops a service and removes installed files. In an agent context, this can lead to destructive actions being taken without the user's informed consent, especially if the skill is triggered unintentionally.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The skill instructs users to run the bundled installer with sudo, which elevates execution to root and allows system-wide changes. While administrative installation may legitimately require privilege, presenting privileged execution without strong guardrails increases the risk of misuse or accidental host modification.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Requires root. First-time install:

bash

sudo bash skills/jdxb/scripts/jdxb.sh install

Or use the official one-liner:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This command combines root execution with a remotely fetched script, so any compromise of the remote source results in immediate privileged code execution. The risk is substantially higher than ordinary sudo usage because the code being executed is not pinned, reviewed, or verified locally first.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Or use the official one-liner:

bash

curl -sL https://iepose.com/install.sh | sudo bash

Service Details

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script downloads an executable package from a plain HTTP URL and then installs and runs it as root via systemd. Because HTTP provides no transport integrity or authenticity, any man-in-the-middle or compromised network path could replace the archive with malicious code and gain persistent root-level execution on the host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/jdxb.sh (reported line 26)May include surrounding context.

sh

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/jdxb.sh (reported line 206)May include surrounding context.

sh

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/jdxb.sh (reported line 207)May include surrounding context.

sh

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/jdxb.sh (reported line 208)May include surrounding context.

sh

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/jdxb.sh (reported line 209)May include surrounding context.

sh

err()   { echo -e "${RED}$1${NC}"; exit 1; }

ensure_root() {
    [[ $EUID -ne 0 ]] && err "需要 root 权限，请用 sudo 运行"
}

status_cmd() {

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/jdxb.sh (reported line 197)May include surrounding context.

sh

EOF
    
    systemctl daemon-reload
    systemctl enable "${APP_NAME}.service"
    
    info "🚀 启动服务..."
    systemctl restart "${APP_NAME}.service"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The uninstall routine removes the systemd service file and recursively deletes the installation directory with rm -rf, which is destructive and irreversible. Although the script prints a success message afterward, it does not warn the user beforehand or ask for confirmation before deleting files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script's user-facing usage and status/error messages are written entirely in Chinese, with no indication that language is configurable or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a locale without offering user choice or documenting a justified restriction.

Content

No source excerpt is available for this finding.