Hardware Llm Optimizer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 1.1.0

Overview

This skill performs disclosed local hardware checks to recommend local LLM sizes, with no evidence of hidden data access, persistence, or exfiltration.

Before installing, understand that the skill may inspect basic local hardware details and run nvidia-smi if available. Install psutil in a virtual environment, avoid running pip as an administrator/root user, and prefer a pinned dependency file if reproducibility matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41-43
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

markdown

## Requirements

- Python 3.8+
- psutil: `pip install psutil`
- nvidia-smi (optional, for NVIDIA GPU detection)

Technical Analysis

The installation instructions direct users to install psutil without specifying a reviewed version, validating package hashes, using a lockfile, or constraining the package index. Consequently, the installed package and its transitive dependencies may change independently of the audited project.

Python package installation can execute package-controlled build or installation logic. If the package distribution or configured package index is compromised, a malicious package artifact could execute code during installation and subsequently when imported by detect.py.

The audit found no evidence that the legitimate psutil package is malicious. The issue is the absence of controls that ensure users install the same reviewed dependency artifact.

Attack Path

1. An attacker compromises the relevant package distribution, a dependency, or a package index configured in the user's environment.
2. The user follows the documented pip install psutil command.
3. Pip resolves an uncontrolled package version or artifact from the configured index.
4. Malicious package build or installation logic executes during installation, or malicious runtime logic executes when detect.py imports psutil.
5. The payload runs with the privileges of the user performing the installation or invoking the Skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. This may expose files, environment variables, credentials, and other resources accessible to that account. If installation is performed from an elevated shell, the impact could extend to admini ...[truncated 254 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin psutil to a reviewed, exact version in a dependency file, such as:

   text

   psutil==<reviewed-version>
   

2. Generate and verify cryptographic hashes for all dependency artifacts, then install with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Use a lockfile produced by a dependency-management tool to make dependency resolution reproducible.

4. Explicitly use a trusted package index, while ensuring that this does not replace TLS and artifact-hash validation:

   bash

   python3 -m pip install --index-url https://pypi.org/simple --require-hashes -r requirements.txt
   

5. Review and update pinned versions through a controlled dependency-update process that includes vulnerability scanning and testing.

6. Recommend installation inside a dedicated virtual environment and discourage elevated or root-level pip installation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises executable behavior (python3 .../detect.py) and hardware auto-detection, which implies shell execution and local system inspection, yet it declares no explicit tool scope or permissions. This creates an authorization and transparency gap: an agent may invoke file reads or shell commands without the skill manifest constraining or disclosing that capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description explicitly states 'Chinese interface,' and the document later says the skill outputs in Chinese for user convenience. This imposes a locale/language choice by default without indicating user opt-in or an alternative language option.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation phrases are generic and high-frequency (e.g. '硬件检测', '大模型推荐', 'LLM优化'), which can cause the skill to trigger in unrelated conversations. Because this skill may perform hardware detection and shell-based checks, unintended invocation could expose local system details or run commands when the user did not clearly request that action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'Chinese Interface' section says the skill outputs in Chinese for user convenience, but it does not offer a language selection mechanism or explain that Chinese is optional. This is a natural-language policy issue because it forces a specific locale absent opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · detect.py (reported line 22)May include surrounding context.

python

def get_cuda_info():
    """检测 CUDA 版本"""
    try:
        result = subprocess.check_output(
            ["nvidia-smi", "--query-gpu=driver_version,compute_cap", "--format=csv,noheader"],
            encoding="utf-8"
        ).strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · detect.py (reported line 85)May include surrounding context.

python

cuda_version = None
    
    try:
        nvidia_output = subprocess.check_output(
            ["nvidia-smi", "--query-gpu=name,memory.total,driver_version", "--format=csv,noheader,nounits"],
            encoding="utf-8"
        ).strip()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level description states the skill behavior in Chinese only, implying a fixed language/locale presentation rather than offering a user choice. The policy for this audit flags language/locale constraints when they are imposed without opt-in or justification.

Content

No source excerpt is available for this finding.