China Mirror Resolver

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:50 AM UTC
• Version: 2.1.0

Overview

This skill has a coherent mirror-switching purpose, but it can persistently redirect package, source-code, and container downloads through third parties with some unsafe or under-scoped defaults.

Install only if you intend to let an agent change development tool and system package sources. Require the agent to show the exact old and new config, avoid pip trusted-host unless you explicitly accept TLS verification bypass, do not use GitHub accelerators for private or token-bearing URLs, prefer official or institutional mirrors, and keep rollback commands handy before allowing Docker, apt, yum, shell-profile, or persistent environment changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:136

Finding

Executable artifacts are routed through insufficiently trusted third-party proxies

Content

View full analysis

https://github.com//.git` ``` `references/config-templates.md:72`: ```bash MIRRORS='["https://docker.1ms.run","https://docker.xuanyuan.me"]' ``` `references/config-templates.md:238-240`: ```bash git clone https://github.com//.git # Example: git clone https://ghfast.top/https://github.com/torvalds/linux.git ``` ### Technical Analysis The Skill directs executable container images and source-code downloads through third-party intermediaries. Some listed services are not identified as official registries, major cloud providers, universities, or independently audited organizations. This conflicts with the Skill's own candidate-selection rules, which state that unknown or unverifiable personal servers must not be used. The validation script only performs HTTP reachability checks. A successful status code proves availability but does not establish operator identity, artifact authenticity, or equivalence with the upstream content. An intermediary can observe requested repository names and can potentially return modified source archives, Git objects, manifests, ...[truncated 2877 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:270

Finding

Default pip guidance disables TLS certificate verification for mirror hosts

Content

View full analysis

--trusted-host ` | `Would install` or `already satisfied` | ``` `references/config-templates.md:10-15`: ```ini [global] index-url = trusted-host = ``` The accompanying warning in `references/config-templates.md:20-22` does not prevent the insecure configuration: ```markdown > **Security note**: `trusted-host` disables SSL verification for that host. > Only use for known institutional mirrors with HTTPS. Prefer mirrors with > valid certificates that don't require `trusted-host`. ``` ### Technical Analysis pip's `trusted-host` setting suppresses normal HTTPS certificate verification for the specified host. As a result, an invalid, expired, self-signed, or attacker-provided certificate may be accepted. This removes a central authenticity guarantee of TLS and allows an on-path attacker to impersonate the configured package index. The option appears in both the tool-specific validation command and the persistent pip configuration template. Therefore, it is presented as part of the standard workflow rather than as a narrowly scoped emergency exception. All baseline pip mirrors in the Skill use HTTPS, and the declared functionality does not inherently require bypassing certificate validation. The warning correctly acknowledges the danger, but a warning alone does not enforce safe behavior. The template can cause the insecure setting to remain active for future installations after the immediate mirror-resolution task is complete. A dry-run does not eliminate the vulnerability. It still queries and trusts package metadata from an unauthenticated endpoint, and the persistent template affects later non-dry-run installations. ### ...[truncated 1782 chars]

Remediation

View remediation

``` 2. Remove `trusted-host` from the default persistent pip configuration: ```ini [global] index-url = ``` 3. Treat certificate validation failures as hard failures and select another mirror with a valid certificate. 4. Do not automatically work around TLS errors. If an exceptional environment genuinely requires a private certificate authority, install the organization's CA certificate through the operating system or pip's supported certificate configuration instead of disabling verification. 5. If `trusted-host` must be retained as an emergency option: - Require explicit user confirmation. - Explain that server identity will not be authenticated. - Scope it to one command rather than persistent configuration. - Restrict it to a user-approved hostname. - Remove the exception immediately after the operation. 6. Verify downloaded package hashes using pinned hashes or a trusted lock file. For high-assurance workflows, use `--require-hashes`. 7. Add an automated check to reject generated pip configurations containing `trusted-host` unless an explicit secure exception policy is active. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code chunk is a network reachability validator, not a resolver/configurator. It sends read-only HTTP requests to predefined mirror endpoints and outputs pass/fail timing results. That aligns partially with the 'validates' portion of the description, but materially misses the core declared behavior of automatically discovering and configuring mirror sources and being 'self-healing.' The implemented scope is also narrower than the declared multi-tool coverage, since this script includes pip, npm, conda, docker, go, rust, maven, homebrew, github, huggingface, and yum, but not several declared ecosystems such as yarn, pnpm, apt, or Gradle. Therefore the description overstates the actual behavior of the supplied code chunk.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Windsurf adaptation sets 'trigger: auto' without meaningful scope constraints, which can cause this skill to run opportunistically across unrelated sessions. Because the skill recommends persistent config edits and network-source changes, unconditional triggering materially raises the risk of accidental system-wide modifications, especially when combined with broad trigger terms elsewhere in the file.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/config-templates.md (reported line 77)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/config-templates.md (reported line 80)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/config-templates.md (reported line 82)May include surrounding context.

else echo "{"registry-mirrors": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null fi sudo systemctl daemon-reload && sudo systemctl restart docker

text

```powershell

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README describes automatic discovery, validation, and configuration of mirrors, but it does not clearly warn users up front that the skill may modify package manager and system tool configuration files. For a skill that can change registries for pip, npm, Docker, apt, and similar tools, lack of explicit disclosure can lead to users unknowingly redirecting trusted software supply paths, which increases supply-chain and persistence risk if a mirror is compromised or misconfigured.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list is very broad and includes generic terms like 'timeout', 'proxy', 'SSL error', and '443', which can cause the skill to activate in unrelated contexts. In an agentic environment, unintended activation can lead to unnecessary network probing, configuration changes, or advice to switch package sources when the real issue is unrelated, increasing the chance of unsafe or disruptive actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill explicitly instructs permanent writes to configuration files across multiple package managers and system tools. In an agent context, persistent modification increases blast radius: a mistaken trigger, incorrect mirror selection, or maliciously influenced candidate source can alter future package resolution, affect supply-chain trust, and survive beyond the current session.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md

### Core Principles

1. **Backup first** — Always backup the original config file before modifying
2. **Merge, don't overwrite** — For JSON configs (Docker daemon.json), read existing content and merge new fields. Never blindly overwrite the entire file
3. **Permanent config** — Write to config files, not just CLI flags
4. **Verify after write** — Run a test command to confirm the new source works

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 76)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 77)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 78)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 218)May include surrounding context.

md

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 80)May include surrounding context.

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON" else echo "{"registry-mirrors": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null fi sudo systemctl daemon-reload && sudo systemctl restart docker

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 82)May include surrounding context.

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON" else echo "{"registry-mirrors": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null fi sudo systemctl daemon-reload && sudo systemctl restart docker

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 199)May include surrounding context.

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON" else echo "{"registry-mirrors": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null fi sudo systemctl daemon-reload && sudo systemctl restart docker

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 214)May include surrounding context.

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON" else echo "{"registry-mirrors": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null fi sudo systemctl daemon-reload && sudo systemctl restart docker

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 219)May include surrounding context.

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON" else echo "{"registry-mirrors": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null fi sudo systemctl daemon-reload && sudo systemctl restart docker

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-templates.md (reported line 225)May include surrounding context.

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON" else echo "{"registry-mirrors": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null fi sudo systemctl daemon-reload && sudo systemctl restart docker

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This guidance tells users to persist Rustup mirror environment variables in shell startup files, causing all future rustup downloads to use the chosen mirror. If the mirror is compromised or insufficiently validated, this creates a durable supply-chain redirection that survives beyond the current session and can affect future toolchain updates.

Content

Scanner excerpt · references/config-templates.md (reported line 127)May include surrounding context.

Rust (rustup)

bash

# Linux / macOS — add to ~/.bashrc or ~/.zshrc
export RUSTUP_DIST_SERVER=<RUSTUP_MIRROR>
export RUSTUP_UPDATE_ROOT=<RUSTUP_MIRROR>/rustup

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Persisting HF_ENDPOINT in shell startup files changes the default source for future Hugging Face API/model interactions across sessions. That long-lived redirection can expose users to malicious or tampered model/content sources if the mirror is not strongly vetted, making the context more dangerous because the skill is specifically about switching to alternate mirror infrastructure.

Content

Scanner excerpt · references/config-templates.md (reported line 248)May include surrounding context.

Hugging Face

bash

# Linux / macOS — add to ~/.bashrc or ~/.zshrc
export HF_ENDPOINT=<MIRROR_URL>

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Line L25 states that section headers were simplified to English-only for cleaner agent parsing. This is a natural-language policy concern because it enforces a specific language choice rather than offering a user-selectable or clearly justified locale option.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.