Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious with high confidence because it reports credential exposure, unsafe diagnostic behavior, and several actions that exceed their stated scope; some files were only partially analyzed.
Given the suspicious verdict, consider not installing until the credential transport, unexpected network activity, local secret discovery, and temporary-file behavior have been reviewed or corrected. The scan is incomplete for three scripts, so these results do not establish that the unreviewed portions are safe.
scripts/probe_sub.pySubscription credentials are transmitted over unauthenticated TLS
The attacker can capture the subscription bearer token and forge diagnostic responses. The playbook additionally recommends using content obtained by the no-SNI method to select a bootstrap node, creating a downstream configuration-integrity risk.
assets/config-template.yamlThe repair template exposes unauthenticated proxy listeners to reachable network peers
Unauthorized peers can consume subscription bandwidth and relay traffic through the user's host or proxy account. Direct-routing rules can also expose destinations reachable from that host.
Referenced artifact was not completely inspected
bash scripts/find_config.sh # 本机
Referenced artifact was not completely inspected
bash scripts/find_config.sh --ssh root@10.0.0.2 # 远程主机 / 软路由 / VPS
Referenced artifact was not completely inspected
bash scripts/find_config.sh --docker mihomo # 配置在容器里（可叠加 --ssh）
Referenced artifact was not completely inspected
bash scripts/find_config.sh --unc # 绿联 NAS（unc CLI 已登录）
Referenced artifact was not completely inspected
| `scripts/find_config.sh` | 每次开工第一步：判形态、定位配置、发现控制接口 |
Referenced artifact was not completely inspected
并在末尾打印可直接复制的 `diagnose.sh` / `apply_config.sh` 命令。
Referenced artifact was not completely inspected
bash scripts/apply_config.sh --new /tmp/new.yaml \
Referenced artifact was not completely inspected
bash scripts/apply_config.sh ... --dry-run
Referenced artifact was not completely inspected
bash scripts/apply_config.sh --rollback 'config.yaml.bak-YYYYMMDD-HHMMSS' \
Referenced artifact was not completely inspected
| `scripts/apply_config.sh` | 改配置统一入口；含备份、SHA 复核、热重载、回滚 |
Referenced artifact was not completely inspected
并在末尾打印可直接复制的 `diagnose.sh` / `apply_config.sh` 命令。
Referenced artifact was not completely inspected
bash scripts/diagnose.sh --api http://<host>:9090 --secret '<secret>'
Referenced artifact was not completely inspected
bash scripts/diagnose.sh --api ... --secret ...
Referenced artifact was not completely inspected
| `scripts/diagnose.sh` | 定位与复检；自动识别代理端口，含直连 vs 代理对照 |
Without declared permissions the skill's intent is opaque and cannot be validated.
The design statement at L005 says subscription updates go through a proxy, but L028 and L040 configure both providers with proxy: DIRECT. Consequently, the default template cannot bypass subscription-domain SNI blocking as that statement implies; the optional bootstrap instructions at L047–L066 require additional configuration before proxied fetching actually occurs.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X PUT -H 'Authorization: Bearer <secret>' -H 'Content-Type: application/json' \
-d '{"path": "/root/.config/mihomo/config.yaml"}' http://127.0.0.1:9090/configs
The remote-controller examples send a reusable bearer secret over plain HTTP. A network observer or active intermediary can capture that secret and use the controller's management capabilities; a private LAN does not guarantee confidentiality.
Contacting the user's controller is legitimate, but these requests transmit its bearer credential to a potentially remote host over unencrypted HTTP. This is the same transport exposure identified by SQP-2, not evidence of an attacker-controlled exfiltration endpoint.
S='<secret>'; H='http://<host>:9090'
curl -s --noproxy '*' -H "Authorization: Bearer $S" $H/version
curl -s --noproxy '*' -H "Authorization: Bearer $S" $H/configs # 端口/模式/tun
curl -s --noproxy '*' -H "Authorization: Bearer $S" $H/proxies # 策略组与 now
curl -s --noproxy '*' -H "Authorization: Bearer $S" $H/providers/proxies
Rollback can send the controller bearer secret to a remote plain-HTTP API without checking transport security. The destination is user-selected rather than a hardcoded exfiltration server, but interception can still expose a reusable management credential.
hr; echo "[重启] $RESTART"
case "$RESTART" in
none) say "跳过" ;;
api) run_or_show "$CURL -s -X PUT -H 'Content-Type: application/json' ${SECRET:+-H 'Authorization: Bearer $SECRET'} -d '{\"path\": \"$COREPATH\"}' '$API/configs'" ;;
unc|docker|auto) run_or_show restart_target ;;
*) run_or_show "$RESTART" ;;
esac
The normal reload path accepts remote HTTP URLs and attaches the controller bearer secret without requiring encrypted transport. Although the request is an intended management operation, network interception can disclose the secret and enable unauthorized controller access.
[ -n "$API" ] || die "--restart api 需要 --api http://host:9090" 2
if [ "$DRYRUN" = 1 ]; then echo " [dry-run] PUT $API/configs {\"path\":\"$COREPATH\"}"
else
code=$($CURL -s -o /tmp/_mh_reload.txt -w '%{http_code}' -m 20 -X PUT \
-H 'Content-Type: application/json' ${SECRET:+-H "Authorization: Bearer $SECRET"} \
-d "{\"path\": \"$COREPATH\"}" "$API/configs")
say "热重载 HTTP=$code $(head -c 120 /tmp/_mh_reload.txt)"
Controller responses containing configuration and proxy inventory are retained in predictable /tmp files without restrictive permissions or cleanup. Depending on the umask and platform protections, other local users can read diagnostic data or exploit precreated paths to redirect writes; the responses need not contain the controller secret for this to be a concern.
The advertised structure-only option still contacts public websites and IP-discovery services, including through a direct connection. This defeats an explicit no-external-probes choice and can disclose the host's real public IP and diagnostic activity when the user expects no public-network traffic.
The documented API-only option merely adds an API candidate and does not stop local configuration discovery. It can consequently read and print an unrelated local controller secret into agent transcripts or captured output, exceeding the user's requested diagnostic scope.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.append("@" + server)
cmd.append(host)
try:
out = subprocess.run(cmd, capture_output=True, text=True, timeout=8).stdout
except Exception:
return []
ips = []