VLAN Linux Client

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:40 AM UTC
• Version: 1.0.0

Overview

This VLAN client skill is purpose-related, but it tells users to run an unverified HTTP installer directly in a shell and includes a privileged recursive delete command.

Review before installing. Do not copy-paste the HTTP curl-to-sh command unless you independently trust and verify the VLAN.CN installer; prefer an official HTTPS package or a downloaded script with a published checksum or signature. Treat the uninstall command carefully and verify the exact path before using sudo deletion.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:17
• Finding: Unverified Remote Installer Executed Directly Through a Shell## Vulnerability Details **File Location**: `README.md:17` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Vulnerable Code Snippet**: ```bash curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh ``` ### Technical Analysis The installation instructions retrieve a mutable shell script from an external server and pipe it directly into `sh`. The URL uses plaintext HTTP, allowing a network-positioned attacker to inspect or modify the response. The `-k` option also disables TLS certificate verification if the request is redirected to HTTPS. No version pin, cryptographic checksum, digital signature, or review step is provided. Because the installer is not included in the audited project, its commands, downloaded components, persistence mechanisms, and privilege requirements cannot be verified. The remote server can change the effective payload at any time after this Skill has been reviewed. ### Attack Path 1. A user follows the documented installation command. 2. The client requests `install.sh` over plaintext HTTP. 3. An attacker controlling the network path, DNS resolution, download server, or upstream hosting account substitutes a malicious script. 4. `curl` sends the response directly to `sh`, without saving it for inspection or verifying its integrity. 5. The malicious script executes with the privileges of the invoking user. 6. If the command is run as root, or if the script persuades the user to grant elevation, the payload can obtain system-wide control. ### Impact Assessment Successful exploitation permits arbitrary shell command execution within the invoking user's security context. This may allow theft of credentials and configuration, modification or destruction of user files, installation of malware, network interception, and access to VLAN-connected resources. System-wide compromise is possible if the command is invoked with elevated privileges or the do ...[truncated 320 chars]
• Remediation: ## Remediation Suggestions 1. Replace plaintext HTTP with authenticated HTTPS and remove the `-k` option. 2. Publish a versioned installer or package through a trusted package repository. 3. Pin the expected release and verify a cryptographic checksum or vendor signature before execution. 4. Download the installer to a local file rather than piping it directly to a shell: ```bash curl --fail --show-error --location --proto '=https' \ --tlsv1.2 https://trusted.example/install-v2.0.sh \ --output install-v2.0.sh sha256sum --check install-v2.0.sh.sha256 less install-v2.0.sh sh install-v2.0.sh ``` 5. Document every filesystem, service, network, and privilege change made by the installer. 6. Run installation with the least privileged account possible and elevate only narrowly scoped operations.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:28
• Finding: Core Skill Instructions Execute a Mutable Remote Script Without Verification## Vulnerability Details **File Location**: `SKILL.md:28` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Vulnerable Code Snippet**: ```bash curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh ``` ### Technical Analysis The Skill's core command reference directs an agent or user to retrieve a shell program from an external endpoint and execute it immediately. Plaintext HTTP provides no transport authenticity or integrity. Moreover, `-k` suppresses certificate validation if an HTTPS redirect occurs. The effective installer is controlled outside the reviewed project and may change without any modification to the Skill. No checksum, signature, immutable version, or confirmation step limits that supply-chain trust. The audit therefore cannot establish what files, services, firewall rules, credentials, or privileges the remote script may affect. ### Attack Path 1. The Skill is triggered for Linux client installation. 2. The user or agent copies or executes the recommended command. 3. A compromised server, DNS response, proxy, or network path supplies attacker-controlled shell content. 4. The pipeline passes that content directly to `sh`. 5. The attacker gains arbitrary command execution under the invoking account. 6. Elevated execution or subsequent privilege prompts may expand compromise to the entire host. ### Impact Assessment The payload can exercise all permissions available to the invoking account, including reading accessible credentials, changing user configuration, modifying files, and initiating arbitrary network connections. It may also interfere with networking or expose resources reachable through the virtual network. Root-level impact is possible if the Skill is used from a privileged shell or the installer obtains elevation, although the absent installer prevents confirmation that it does so. The remote execution channel is unnecessary for merely doc ...[truncated 104 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | sh` pipeline from the core command reference. 2. Require HTTPS with normal certificate and hostname verification; never use `-k`. 3. Reference an immutable, versioned release artifact from a trusted official repository. 4. Require signature or checksum validation before execution. 5. Instruct users to inspect the downloaded script and execute it as a separate step. 6. Describe the exact privileges required and separate unprivileged setup from narrowly scoped privileged changes. 7. Prefer a signed distribution package and the operating system's package manager where available.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:106
• Finding: Installation Example Repeats Unauthenticated Remote Shell Execution## Vulnerability Details **File Location**: `SKILL.md:106` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Vulnerable Code Snippet**: ```bash curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh ``` ### Technical Analysis The first-installation response template repeats the unsafe installer pipeline. This is particularly risky because the content is presented as the direct answer an agent should give to a user, increasing the likelihood of execution without independent review. The payload is transferred over unauthenticated HTTP and executed while still streaming. There is no integrity validation or pinned release, and `-k` would prevent certificate verification following an HTTPS redirect. Since the script is hosted remotely and is absent from the project, its behavior can change after audit and its privilege scope cannot be established. ### Attack Path 1. A user asks how to install the VLAN client. 2. The agent returns the documented first-installation example. 3. The user executes the provided command. 4. An attacker substitutes the HTTP response through network interception, DNS compromise, server compromise, or upstream replacement. 5. The substituted response is executed immediately by `sh`. 6. The payload performs arbitrary actions with user privileges and may seek or inherit administrative privileges. ### Impact Assessment Exploitation can compromise the invoking account, its accessible data, authentication material, and network access. The payload may modify the local environment, install additional components, or communicate with attacker-controlled systems. If executed with administrative privileges, the impact may include system-wide file modification, service installation, security-control changes, and persistent compromise. Such elevated effects are possible but cannot be confirmed because the actual remote installer was not available for inspecti ...[truncated 3 chars]
• Remediation: ## Remediation Suggestions 1. Replace the response template with a safe, multi-step installation procedure. 2. Download only over verified HTTPS and remove `-k`. 3. Pin the installer to a specific release and publish its expected SHA-256 digest or signing key. 4. Verify the artifact before execution and provide an explicit review step. 5. Avoid instructing an agent to execute installation automatically; require informed user confirmation. 6. State precisely which steps require elevation and keep all other operations unprivileged. 7. Update every duplicate installation example so unsafe instructions are not reintroduced from another section.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

External Script Fetching

High

• Category: Supply Chain

Content

### 安装 VLAN 客户端
```bash
curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh
```

### 登录

• Confidence: 99% confidence
• Finding: The README fetches an external script over plain HTTP and executes it, allowing arbitrary code execution if the remote host, DNS, CDN, or network path is compromised. The use of HTTP instead of HTTPS makes this especially severe because passive and active attackers can tamper with the script in transit.

Chaining Abuse

High

• Category: Tool Misuse

Content

### 安装 VLAN 客户端
```bash
curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh
```

### 登录

• Confidence: 98% confidence
• Finding: The pipe to sh is a classic command-chaining pattern that turns content retrieval into immediate code execution with no validation boundary. In a client installation guide, this is more dangerous because users are likely to copy-paste it verbatim, increasing the chance of compromise through malicious or altered script content.

External Script Fetching

High

• Category: Supply Chain

Content

### 安装命令
```bash
curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh
```

### 基础用法

• Confidence: 99% confidence
• Finding: The installation command fetches an external script over plain HTTP and executes it immediately, making the installation path vulnerable to man-in-the-middle tampering, server compromise, or content substitution. The inclusion of `-k` further signals unsafe transport assumptions and undermines trust verification.

Chaining Abuse

High

• Category: Tool Misuse

Content

### 安装命令
```bash
curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh
```

### 基础用法

• Confidence: 99% confidence
• Finding: The `| sh` pipeline removes any review boundary between untrusted downloaded content and command execution, enabling immediate arbitrary code execution. In this skill context, it is especially dangerous because it is presented as the primary installation path users are likely to copy verbatim.

External Script Fetching

High

• Category: Supply Chain

Content

回复：
```bash
# 使用官方一键安装脚本
curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh

# 安装完成后，使用登录码登录（推荐）
vlancli login <你的登录码>

• Confidence: 99% confidence
• Finding: This repeated example reinforces the same unsafe practice of downloading and executing remote code without verification. Repetition in example workflows increases the likelihood users will copy-paste the command directly, amplifying practical exploitability.

Chaining Abuse

High

• Category: Tool Misuse

Content

回复：
```bash
# 使用官方一键安装脚本
curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh

# 安装完成后，使用登录码登录（推荐）
vlancli login <你的登录码>

• Confidence: 99% confidence
• Finding: This example repeats the dangerous shell-chaining pattern, normalizing direct execution of remote content. Repeated unsafe examples materially increase risk because they encourage habitual copy-paste execution without verification.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

vlancli stop

# 删除客户端文件（具体路径参考安装文档）
sudo rm -rf /usr/local/vlan
```

---

• Confidence: 94% confidence
• Finding: The command `rm -rf /usr/local/vlan` is a forceful recursive deletion of an absolute path and can cause irreversible data loss if the path is mistyped, substituted, or broader than expected. In documentation intended for copy-paste use, such commands are inherently hazardous, especially when paired with `sudo`.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

vlancli stop

# 删除客户端文件（具体路径参考安装文档）
sudo rm -rf /usr/local/vlan
```

---

• Confidence: 94% confidence
• Finding: The command `rm -rf /usr/local/vlan` is a forceful recursive deletion of an absolute path and can cause irreversible data loss if the path is mistyped, substituted, or broader than expected. In documentation intended for copy-paste use, such commands are inherently hazardous, especially when paired with `sudo`.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The README instructs users to download and immediately execute a remote shell script from an unauthenticated HTTP URL. This creates a direct supply-chain and man-in-the-middle risk because any party able to tamper with the network path or hosting server can execute arbitrary code on the user's system.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The command pipes downloaded content directly into sh with no warning, review step, or integrity verification. This is dangerous because it normalizes execution of untrusted remote code and gives the fetched script immediate shell execution privileges.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill instructs users to fetch and immediately execute a remote shell script via `curl ... | sh`, with `-k` disabling certificate verification and using plain HTTP, which removes transport authenticity and integrity protections. If the download source or network path is compromised, arbitrary code will run on the user's system with no opportunity for inspection.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

1. **登录安全**：推荐使用登录码方式，避免在命令行历史中留下密码
2. **登录码有效期**：登录码仅 30 分钟有效，超时需重新生成
3. **权限要求**：部分命令可能需要 sudo 权限
4. **防火墙**：确保系统防火墙允许 VLAN 客户端的网络流量
5. **网络依赖**：客户端需要能访问 api.vlan.cn 服务器

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The uninstall section includes a recursive deletion command without an explicit warning about its destructive nature or guidance to verify the target path. While scoped to `/usr/local/vlan`, mistakes in transcription, variable expansion, or future path changes could cause unintended data loss, especially when run with elevated privileges.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

vlancli stop

# 删除客户端文件（具体路径参考安装文档）
sudo rm -rf /usr/local/vlan
```

---

• Confidence: 95% confidence
• Finding: The skill instructs users to run `sudo rm -rf /usr/local/vlan`, combining elevated privileges with forceful recursive deletion. Although intended for uninstall, privileged destructive commands increase the blast radius of mistakes and can remove unintended files if the path is wrong or altered.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The natural-language instructions and headings are written in Chinese throughout the file, and the document does not offer an alternate language or indicate that Chinese is optional. This can violate a language/locale policy when a skill forces a specific language without user opt-in.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:193