Hardware LLM Optimizer v2 (llmfit)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 2.0.0

Overview

The skill fits a hardware-based LLM recommendation purpose, but it tells users to run an unverified remote installer that can execute arbitrary local code.

Review this skill before installing. Do not run the `curl | sh` installer unless you independently trust and verify the llmfit source; prefer a pinned, checksummed, or signed release. Expect local CPU/RAM/GPU inspection and Chinese-language output.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:102

Finding

Unverified Remote Installer Downloaded and Executed Through a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 102
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash

curl -fsSL https://llmfit.axjns.dev/install.sh | sh

Technical Analysis

The installation instruction retrieves a mutable shell script from the external domain llmfit.axjns.dev and pipes it directly into sh. No version pinning, cryptographic checksum, signature verification, local review, or trusted package-manager validation occurs before execution.

Consequently, the code that executes can differ from the code available when the Skill was audited. Compromise of the remote server, domain, hosting infrastructure, or release process—or intentional modification by its operator—would permit arbitrary shell commands to be delivered to users.

This behavior is not required for the bundled hardware detection logic. detect.py performs local hardware inspection and recommendations without downloading executable content. The instruction therefore creates a code-execution channel beyond the minimum privileges necessary for that local functionality. The document also states that llmfit is installed at /usr/local/bin/llmfit, but the repository does not provide verifiable provenance for that external executable.

Attack Path

1. A user or agent follows the installation instruction in SKILL.md.
2. curl connects to the external host and retrieves its current install.sh response.
3. The response is streamed directly to sh without being saved, inspected, or authenticated.
4. Any commands supplied by the remote host execute with the permissions of the invoking account.
5. If the command is run by an administrator or the installer invokes privilege-elevation mechanisms, the resulting impact may extend to system-wide resources.

Impact Assessment

A malicious remote response can obtain arbitrary code execution with the invoking ...[truncated 552 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | sh installation instruction.
2. Prefer a version-pinned package distributed through a reputable package registry with integrity metadata and reproducible release provenance.
3. Alternatively, include the installer in the repository so it can be audited alongside the Skill.
4. If downloading an installer remains necessary:
   • Use an immutable, version-specific release URL.
   • Download it to a local file rather than piping it into a shell.
   • Verify a cryptographic signature from a separately established trust root.
   • Verify a published strong checksum such as SHA-256.
   • Permit the user to inspect the script before execution.
   • Require explicit user approval before running it.
5. Avoid system-wide installation and elevated privileges unless they are demonstrably necessary. Install into a user-controlled directory where possible.
6. Document the expected files, network access, permissions, and changes performed by the installer.
7. Verify and document the provenance and integrity of the claimed /usr/local/bin/llmfit executable before invoking it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The metadata and content make strong claims about llmfit integration, TUI support, simulation, throughput estimation, and a large model catalog that are not substantiated by the skill content. In a security context, capability inflation is dangerous because operators may trust the skill to perform vetted behavior while it actually depends on undocumented external components or encourages unsafe manual steps.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends fetching and executing a remote install script directly from the network. This is dangerous because any compromise of the remote host, TLS trust chain, DNS, or script contents results in immediate arbitrary code execution on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

安装llmfit（如需）

bash

curl -fsSL https://llmfit.axjns.dev/install.sh | sh

优势对比

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh pattern is a classic command-chaining anti-pattern that executes untrusted network content immediately with no inspection or integrity verification. In this skill's context, the installation command is presented as normal workflow, making exploitation especially plausible if users follow it verbatim.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

安装llmfit（如需）

bash

curl -fsSL https://llmfit.axjns.dev/install.sh | sh

优势对比

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill instructs use of shell commands and relies on reading local hardware state, but it declares no explicit tool scope or permissions. In an agent setting this weakens least-privilege controls and can cause the skill to be invoked with broader-than-necessary capabilities or without adequate review of shell/file access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are very broad, covering common requests like model recommendations and hardware detection. Over-broad routing increases the chance this skill is auto-selected in unrelated contexts, causing unnecessary shell execution or exposing users to risky installation instructions when a safer or more relevant skill should have handled the request.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · detect.py (reported line 22)May include surrounding context.

python

def get_cuda_info():
    """检测 CUDA 版本"""
    try:
        result = subprocess.check_output(
            ["nvidia-smi", "--query-gpu=driver_version,compute_cap", "--format=csv,noheader"],
            encoding="utf-8"
        ).strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · detect.py (reported line 85)May include surrounding context.

python

cuda_version = None
    
    try:
        nvidia_output = subprocess.check_output(
            ["nvidia-smi", "--query-gpu=name,memory.total,driver_version", "--format=csv,noheader,nounits"],
            encoding="utf-8"
        ).strip()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description and operating instructions are presented entirely in Chinese, which can impose a language requirement on users without opt-in. The file does not state that the skill is intended only for a Chinese-speaking audience or provide an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module description states the tool's behavior entirely in Chinese, and all user-facing messages throughout the script are also fixed in Chinese. This creates a language/locale constraint without any documented opt-in or alternative, which matches the policy concern for forced language selection.

Content

No source excerpt is available for this finding.