Hardware LLM Optimizer v2 (llmfit)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 2.0.0

Overview

The skill fits a hardware-based LLM recommendation purpose, but it tells users to run an unverified remote installer that can execute arbitrary local code.

Review this skill before installing. Do not run the `curl | sh` installer unless you independently trust and verify the llmfit source; prefer a pinned, checksummed, or signed release. Expect local CPU/RAM/GPU inspection and Chinese-language output.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:102
• Finding: Unverified Remote Installer Downloaded and Executed Through a Shell## Vulnerability Details **File Location**: `SKILL.md`, line 102 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://llmfit.axjns.dev/install.sh | sh ``` ### Technical Analysis The installation instruction retrieves a mutable shell script from the external domain `llmfit.axjns.dev` and pipes it directly into `sh`. No version pinning, cryptographic checksum, signature verification, local review, or trusted package-manager validation occurs before execution. Consequently, the code that executes can differ from the code available when the Skill was audited. Compromise of the remote server, domain, hosting infrastructure, or release process—or intentional modification by its operator—would permit arbitrary shell commands to be delivered to users. This behavior is not required for the bundled hardware detection logic. `detect.py` performs local hardware inspection and recommendations without downloading executable content. The instruction therefore creates a code-execution channel beyond the minimum privileges necessary for that local functionality. The document also states that `llmfit` is installed at `/usr/local/bin/llmfit`, but the repository does not provide verifiable provenance for that external executable. ### Attack Path 1. A user or agent follows the installation instruction in `SKILL.md`. 2. `curl` connects to the external host and retrieves its current `install.sh` response. 3. The response is streamed directly to `sh` without being saved, inspected, or authenticated. 4. Any commands supplied by the remote host execute with the permissions of the invoking account. 5. If the command is run by an administrator or the installer invokes privilege-elevation mechanisms, the resulting impact may extend to system-wide resources. ### Impact Assessment A malicious remote response can obtain arbitrary code execution with the invoking ...[truncated 552 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | sh` installation instruction. 2. Prefer a version-pinned package distributed through a reputable package registry with integrity metadata and reproducible release provenance. 3. Alternatively, include the installer in the repository so it can be audited alongside the Skill. 4. If downloading an installer remains necessary: - Use an immutable, version-specific release URL. - Download it to a local file rather than piping it into a shell. - Verify a cryptographic signature from a separately established trust root. - Verify a published strong checksum such as SHA-256. - Permit the user to inspect the script before execution. - Require explicit user approval before running it. 5. Avoid system-wide installation and elevated privileges unless they are demonstrably necessary. Install into a user-controlled directory where possible. 6. Document the expected files, network access, permissions, and changes performed by the installer. 7. Verify and document the provenance and integrity of the claimed `/usr/local/bin/llmfit` executable before invoking it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The metadata and content make strong claims about llmfit integration, TUI support, simulation, throughput estimation, and a large model catalog that are not substantiated by the skill content. In a security context, capability inflation is dangerous because operators may trust the skill to perform vetted behavior while it actually depends on undocumented external components or encourages unsafe manual steps.

External Script Fetching

High

• Category: Supply Chain

Content

## 安装llmfit（如需）

```bash
curl -fsSL https://llmfit.axjns.dev/install.sh | sh
```

## 优势对比

• Confidence: 98% confidence
• Finding: The skill recommends fetching and executing a remote install script directly from the network. This is dangerous because any compromise of the remote host, TLS trust chain, DNS, or script contents results in immediate arbitrary code execution on the user's system.

Chaining Abuse

High

• Category: Tool Misuse

Content

## 安装llmfit（如需）

```bash
curl -fsSL https://llmfit.axjns.dev/install.sh | sh
```

## 优势对比

• Confidence: 99% confidence
• Finding: The `| sh` pattern is a classic command-chaining anti-pattern that executes untrusted network content immediately with no inspection or integrity verification. In this skill's context, the installation command is presented as normal workflow, making exploitation especially plausible if users follow it verbatim.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill instructs use of shell commands and relies on reading local hardware state, but it declares no explicit tool scope or permissions. In an agent setting this weakens least-privilege controls and can cause the skill to be invoked with broader-than-necessary capabilities or without adequate review of shell/file access.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are very broad, covering common requests like model recommendations and hardware detection. Over-broad routing increases the chance this skill is auto-selected in unrelated contexts, causing unnecessary shell execution or exposing users to risky installation instructions when a safer or more relevant skill should have handled the request.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def get_cuda_info():
    """检测 CUDA 版本"""
    try:
        result = subprocess.check_output(
            ["nvidia-smi", "--query-gpu=driver_version,compute_cap", "--format=csv,noheader"],
            encoding="utf-8"
        ).strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cuda_version = None
    
    try:
        nvidia_output = subprocess.check_output(
            ["nvidia-smi", "--query-gpu=name,memory.total,driver_version", "--format=csv,noheader,nounits"],
            encoding="utf-8"
        ).strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The description and operating instructions are presented entirely in Chinese, which can impose a language requirement on users without opt-in. The file does not state that the skill is intended only for a Chinese-speaking audience or provide an alternative language option.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The module description states the tool's behavior entirely in Chinese, and all user-facing messages throughout the script are also fixed in Chinese. This creates a language/locale constraint without any documented opt-in or alternative, which matches the policy concern for forced language selection.

Static analysis

No suspicious patterns detected.