toolchain-bootstrap

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

This skill does what it says at a high level, but it installs and runs an unverified remote toolchain and persistently changes shell startup behavior without enough containment or user control.

Install only if you trust the GitHub release owner and are comfortable with a remote binary archive affecting future shell sessions. Prefer a version that verifies a pinned checksum or signature, extracts into a staging directory, avoids automatic ~/.bashrc edits, and lets you opt in to PATH changes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/bootstrap.sh:7

Finding

Unverified Remote Toolchain Download and Immediate Execution

Content

View full analysis

/dev/null | head -1 | tr -d '\n' || echo "OK") ok "$name: $ver" else err "$name: 未安装" failed=$((failed+1)) fi } check_tool "$TOOLCHAIN/go/bin/go" "Go" "$TOOLCHAIN/go/bin/go version" check_tool "$TOOLCHAIN/jdk-21.0.10+7/bin/java" "Java" "$TOOLCHAIN/jdk-21.0.10+7/bin/java -version 2>&1 | head -1" check_tool "$TOOLCHAIN/apache-maven-3.9.6/bin/mvn" "Maven" "$TOOLCHAIN/apache-maven-3.9.6/bin/mvn -version 2>&1 | head -1" check_tool "$TOOLCHAIN/erlang/bin/erl" "Erlang" "$TOOLCHAIN/erlang/bin/erl -eval 'erlang:display(erlang:system_info(otp_release)),halt().' -noshell 2>/dev/null" check_tool "$TOOLCHAIN/elixir/bin/elixir" "Elixir" "$TOOLCHAIN/elixir/bin/elixir --version 2>&1 | head -1" RUST_BIN=$(ls $TOOLCHAIN/rust/rustup/toolchains/*/bin/rustc 2>/dev/null | head -1) if [ -n "$RUST_BIN" ] && [ -x "$RUST_BIN" ]; then ok "Rust: $($RUST_BIN --version 2>&1 | awk '{print $2}')" ...[truncated 2570 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: scripts/setup-env.sh:9

Finding

Persistent PATH Precedence Enables Tool Hijacking

Content

View full analysis

"$ENV_FILE" echo "[OK] 环境变量已写入 $ENV_FILE" # 尝试追加到 bashrc（如果可写） BASHRC="${HOME}/.bashrc" if [ -w "$BASHRC" ] 2>/dev/null; then if ! grep -q "OpenClaw Toolchain Environment" "$BASHRC" 2>/dev/null; then printf '%s\n' "$ENV_BLOCK" >> "$BASHRC" echo "[OK] 环境变量已追加到 ~/.bashrc" fi fi ``` ### Technical Analysis The script places multiple directories populated by the downloaded archive before the user's existing `PATH`. In particular, the generic `/workspace/toolchain/bin` directory can contain executables with names matching common system commands. Shell command resolution will prefer these files over legitimate programs later in `PATH`. The environment block is also appended to `~/.bashrc`, causing the altered command-resolution behavior to survive the Skill invocation and affect future interactive Bash sessions. The script does not validate the installed filenames, directory ownership, permissions, or integrity before establishing this trust. The Skill legitimately needs a way to expose installed language tools. However, automatically and persistently prepending a broad, remotely populated executable tree ...[truncated 1746 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bootstrap.sh:26

Finding

Predictable Temporary File and Unvalidated Direct Archive Extraction

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill metadata and body describe downloading, extracting, and verifying a toolchain, but the finding indicates the implemented behavior does not match that description and also modifies ~/.bashrc without clearly declaring that side effect. Behavior-description mismatch is dangerous because users and reviewers may approve the skill based on incomplete expectations while it performs persistent environment changes.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 31)May include surrounding context.

sh

curl -L --progress-bar "$RELEASE_URL" -o /tmp/toolchain_v2.tar.gz
    info "解压到 /workspace/ ..."
    tar -xzf /tmp/toolchain_v2.tar.gz -C /workspace/
    rm -f /tmp/toolchain_v2.tar.gz
  fi

  # 配置环境变量

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill clearly describes shell-capable behavior such as setup, PATH modification, and environment bootstrapping, but it declares no tool scope or allowed-tools restrictions. This increases the chance that an agent executes shell actions without explicit user-visible permission boundaries, which weakens containment and review of potentially dangerous operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Downloading and extracting an external archive into /workspace introduces supply-chain and filesystem risks, especially if the archive contents are not authenticated or if extraction could overwrite files. Failing to warn users about this external fetch and write behavior makes the action less transparent and more likely to be executed without proper scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Persistently modifying ~/.bashrc and PATH can alter future shell behavior, shadow trusted binaries, and create hard-to-detect persistence in the development environment. Omitting a clear warning deprives users of informed consent about a state-changing action that survives the current session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This shell script presents its operational status and completion guidance in Chinese strings such as the install, verification, and usage messages. That enforces a specific language for all users without offering a language choice or documenting a justified locale constraint, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The verification, listing, and usage paths contain multiple hard-coded Chinese messages, including missing-tool notices and help text. Because the script applies this locale universally rather than offering choice or documenting a justified regional limitation, it violates the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script contains natural-language comments and status/output strings exclusively in Chinese, including the title and all user-facing operational messages. Because the file does not offer a language opt-in or explain that it is intentionally region-specific, it may violate a language/locale policy requiring user choice or broader accessibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest explicitly states that the skill will automatically download an archive from GitHub, extract it into /workspace, and modify PATH, but it does not mention any confirmation, integrity verification, or trust boundary. In a bootstrap skill, this is risky because it introduces remote code/content into the environment and changes execution behavior system-wide, increasing the chance of supply-chain compromise or accidental execution of untrusted binaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language instructions and description are presented in Chinese, which can impose a language constraint on users without opt-in. Under the policy, language-specific behavior should either provide user choice or clearly document a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description is written entirely in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This may violate language/locale policy when a skill imposes a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.