China Mirror Resolver

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:50 AM UTC
• Version: 2.1.0

Overview

This skill has a coherent mirror-switching purpose, but it can persistently redirect package, source-code, and container downloads through third parties with some unsafe or under-scoped defaults.

Install only if you intend to let an agent change development tool and system package sources. Require the agent to show the exact old and new config, avoid pip trusted-host unless you explicitly accept TLS verification bypass, do not use GitHub accelerators for private or token-bearing URLs, prefer official or institutional mirrors, and keep rollback commands handy before allowing Docker, apt, yum, shell-profile, or persistent environment changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:136
• Finding: Executable artifacts are routed through insufficiently trusted third-party proxies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:136-139`, `SKILL.md:184-186`, `SKILL.md:361`; `scripts/validate.sh:120-123`, `scripts/validate.sh:158-160`; `references/config-templates.md:72`, `references/config-templates.md:238-240` **Vulnerability Type**: Third-party software supply-chain exposure **Risk Level**: High ### Vulnerable Code `SKILL.md:136-139`: ```markdown | Provider | URL | |---|---| | 1ms.run | `https://docker.1ms.run` | | xuanyuan.me | `https://docker.xuanyuan.me` | | DaoCloud | `https://docker.m.daocloud.io` | | linkedbus | `https://docker.linkedbus.com` | ``` `SKILL.md:184-186`: ```markdown | Provider | Prefix URL | |---|---| | ghfast.top | `https://ghfast.top/` | | gh-proxy.com | `https://gh-proxy.com/` | | ghp.ci | `https://ghp.ci/` | ``` `SKILL.md:361`: ```markdown **GitHub**: Prepend accelerator prefix: `git clone <PREFIX>https://github.com/<owner>/<repo>.git` ``` `references/config-templates.md:72`: ```bash MIRRORS='["https://docker.1ms.run","https://docker.xuanyuan.me"]' ``` `references/config-templates.md:238-240`: ```bash git clone <ACCEL_PREFIX>https://github.com/<owner>/<repo>.git # Example: git clone https://ghfast.top/https://github.com/torvalds/linux.git ``` ### Technical Analysis The Skill directs executable container images and source-code downloads through third-party intermediaries. Some listed services are not identified as official registries, major cloud providers, universities, or independently audited organizations. This conflicts with the Skill's own candidate-selection rules, which state that unknown or unverifiable personal servers must not be used. The validation script only performs HTTP reachability checks. A successful status code proves availability but does not establish operator identity, artifact authenticity, or equivalence with the upstream content. An intermediary can observe requested repository names and can potentially return modified source archives, Git objects, manifests, ...[truncated 2877 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove non-institutional and insufficiently verifiable Docker and GitHub proxies from the baseline list. 2. Prefer official registries, official provider mirrors, enterprise Nexus/Artifactory instances, universities, and major cloud vendors with documented ownership. 3. Require explicit, informed user approval before routing executable artifacts through any third party. 4. Do not use GitHub accelerators for private repositories. Reject URLs containing user information, tokens, query-string credentials, or other secrets. 5. Validate the final artifact rather than only checking endpoint reachability: - Pin container images by trusted digest. - Enable and enforce supported image-signing mechanisms. - Compare Git commit IDs and signed tags against values obtained independently from the official upstream. - Verify package signatures and checksums through a separate trusted channel. 6. Use a strict hostname allowlist rather than accepting arbitrary web-search results. 7. Record why each baseline provider is trusted, including ownership and official documentation. 8. Apply mirror settings only for the affected operation where possible. Avoid persistent system-wide Docker configuration unless the user explicitly requests it. 9. Display the old and new trust boundaries before applying configuration and provide an immediate rollback command. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:270
• Finding: Default pip guidance disables TLS certificate verification for mirror hosts<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:270`, `SKILL.md:306-310`; `references/config-templates.md:10-22` **Vulnerability Type**: TLS certificate validation bypass **Risk Level**: High ### Vulnerable Code `SKILL.md:270`: ```markdown | pip | `pip install --dry-run requests -i <URL> --trusted-host <HOST>` | `Would install` or `already satisfied` | ``` `references/config-templates.md:10-15`: ```ini [global] index-url = <MIRROR_URL> trusted-host = <MIRROR_HOST> ``` The accompanying warning in `references/config-templates.md:20-22` does not prevent the insecure configuration: ```markdown > **Security note**: `trusted-host` disables SSL verification for that host. > Only use for known institutional mirrors with HTTPS. Prefer mirrors with > valid certificates that don't require `trusted-host`. ``` ### Technical Analysis pip's `trusted-host` setting suppresses normal HTTPS certificate verification for the specified host. As a result, an invalid, expired, self-signed, or attacker-provided certificate may be accepted. This removes a central authenticity guarantee of TLS and allows an on-path attacker to impersonate the configured package index. The option appears in both the tool-specific validation command and the persistent pip configuration template. Therefore, it is presented as part of the standard workflow rather than as a narrowly scoped emergency exception. All baseline pip mirrors in the Skill use HTTPS, and the declared functionality does not inherently require bypassing certificate validation. The warning correctly acknowledges the danger, but a warning alone does not enforce safe behavior. The template can cause the insecure setting to remain active for future installations after the immediate mirror-resolution task is complete. A dry-run does not eliminate the vulnerability. It still queries and trusts package metadata from an unauthenticated endpoint, and the persistent template affects later non-dry-run installations. ### ...[truncated 1782 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--trusted-host` from the standard validation command: ```bash pip install --dry-run requests -i <URL> ``` 2. Remove `trusted-host` from the default persistent pip configuration: ```ini [global] index-url = <MIRROR_URL> ``` 3. Treat certificate validation failures as hard failures and select another mirror with a valid certificate. 4. Do not automatically work around TLS errors. If an exceptional environment genuinely requires a private certificate authority, install the organization's CA certificate through the operating system or pip's supported certificate configuration instead of disabling verification. 5. If `trusted-host` must be retained as an emergency option: - Require explicit user confirmation. - Explain that server identity will not be authenticated. - Scope it to one command rather than persistent configuration. - Restrict it to a user-approved hostname. - Remove the exception immediately after the operation. 6. Verify downloaded package hashes using pinned hashes or a trusted lock file. For high-assurance workflows, use `--require-hashes`. 7. Add an automated check to reject generated pip configurations containing `trusted-host` unless an explicit secure exception policy is active. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The code chunk is a network reachability validator, not a resolver/configurator. It sends read-only HTTP requests to predefined mirror endpoints and outputs pass/fail timing results. That aligns partially with the 'validates' portion of the description, but materially misses the core declared behavior of automatically discovering and configuring mirror sources and being 'self-healing.' The implemented scope is also narrower than the declared multi-tool coverage, since this script includes pip, npm, conda, docker, go, rust, maven, homebrew, github, huggingface, and yum, but not several declared ecosystems such as yarn, pnpm, apt, or Gradle. Therefore the description overstates the actual behavior of the supplied code chunk.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The Windsurf adaptation sets 'trigger: auto' without meaningful scope constraints, which can cause this skill to run opportunistically across unrelated sessions. Because the skill recommends persistent config edits and network-source changes, unconditional triggering materially raises the risk of accidental system-wide modifications, especially when combined with broad trigger terms elsewhere in the file.

Chaining Abuse

High

• Category: Tool Misuse

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null
fi
sudo systemctl daemon-reload && sudo systemctl restart docker
```

```powershell

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README describes automatic discovery, validation, and configuration of mirrors, but it does not clearly warn users up front that the skill may modify package manager and system tool configuration files. For a skill that can change registries for pip, npm, Docker, apt, and similar tools, lack of explicit disclosure can lead to users unknowingly redirecting trusted software supply paths, which increases supply-chain and persistence risk if a mirror is compromised or misconfigured.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list is very broad and includes generic terms like 'timeout', 'proxy', 'SSL error', and '443', which can cause the skill to activate in unrelated contexts. In an agentic environment, unintended activation can lead to unnecessary network probing, configuration changes, or advice to switch package sources when the real issue is unrelated, increasing the chance of unsafe or disruptive actions.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Core Principles

1. **Backup first** — Always backup the original config file before modifying
2. **Merge, don't overwrite** — For JSON configs (Docker daemon.json), read existing content and merge new fields. Never blindly overwrite the entire file
3. **Permanent config** — Write to config files, not just CLI flags
4. **Verify after write** — Run a test command to confirm the new source works

• Confidence: 90% confidence
• Finding: The skill explicitly instructs permanent writes to configuration files across multiple package managers and system tools. In an agent context, persistent modification increases blast radius: a mistaken trigger, incorrect mirror selection, or maliciously influenced candidate source can alter future package resolution, affect supply-chain trust, and survive beyond the current session.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -f "$DAEMON_JSON" ]; then
    # Merge: preserve existing fields, update registry-mirrors
    sudo cp "$DAEMON_JSON" "${DAEMON_JSON}.bak"
    jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null
fi
sudo systemctl daemon-reload && sudo systemctl restart docker
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null
fi
sudo systemctl daemon-reload && sudo systemctl restart docker
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null
fi
sudo systemctl daemon-reload && sudo systemctl restart docker
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null
fi
sudo systemctl daemon-reload && sudo systemctl restart docker
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null
fi
sudo systemctl daemon-reload && sudo systemctl restart docker
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq --argjson mirrors "$MIRRORS" '. + {"registry-mirrors": $mirrors}' "$DAEMON_JSON" | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
    sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
else
    echo "{\"registry-mirrors\": $MIRRORS}" | sudo tee "$DAEMON_JSON" > /dev/null
fi
sudo systemctl daemon-reload && sudo systemctl restart docker
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Rust (rustup)

```bash
# Linux / macOS — add to ~/.bashrc or ~/.zshrc
export RUSTUP_DIST_SERVER=<RUSTUP_MIRROR>
export RUSTUP_UPDATE_ROOT=<RUSTUP_MIRROR>/rustup
```

• Confidence: 90% confidence
• Finding: This guidance tells users to persist Rustup mirror environment variables in shell startup files, causing all future rustup downloads to use the chosen mirror. If the mirror is compromised or insufficiently validated, this creates a durable supply-chain redirection that survives beyond the current session and can affect future toolchain updates.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Hugging Face

```bash
# Linux / macOS — add to ~/.bashrc or ~/.zshrc
export HF_ENDPOINT=<MIRROR_URL>
```

• Confidence: 90% confidence
• Finding: Persisting HF_ENDPOINT in shell startup files changes the default source for future Hugging Face API/model interactions across sessions. That long-lived redirection can expose users to malicious or tampered model/content sources if the mirror is not strongly vetted, making the context more dangerous because the skill is specifically about switching to alternate mirror infrastructure.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: Line L25 states that section headers were simplified to English-only for cleaner agent parsing. This is a natural-language policy concern because it enforces a specific language choice rather than offering a user-selectable or clearly justified locale option.

Static analysis

No suspicious patterns detected.