ClawHub
Back to skill

Security audit

Model Migrate Flagos

Security checks for vulnerabilities and agentic risk

Overview

The skill has a real model-migration purpose, but it needs Review because it can forcibly kill GPU workloads and launch broad, unauthenticated local or remote model services.

Install only in an isolated development environment where interrupting GPU work is acceptable. Do not run it on shared or production GPU hosts without first removing the blanket kill -9 instructions, binding services to localhost or a protected network, disabling trust-remote-code unless the exact model code is reviewed, validating remote config values, using non-root SSH with host-key checking enabled, and confirming any process termination with the user.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/e2e_remote_serve.sh:13
Finding

Configuration and Model Values Permit Local and Remote Shell Command Injection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/e2e_remote_serve.sh:34
Finding

SSH Host Authentication Is Explicitly Disabled

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/operational-rules.md:88
Finding

Skill Mandates Force-Killing All Visible GPU Compute Processes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/e2e_eval.py:100
Finding

Prompts and Model Outputs Are Transmitted Over Unauthenticated Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/benchmark.sh:8
Finding

Untrusted Model Repository Code Execution Is Enabled by Default

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (54)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · README.md (reported line 115)May include surrounding context.

md
| P1 | Relative -> Absolute imports | `from .xxx` -> `from vllm.*` or `from vllm_fl.*` |
| P2 | Config import redirect | Point to plugin's Config Bridge |
| P3 | Remove missing APIs | `MambaStateCopyFunc` etc. don't exist in 0.13.0 |
| P4 | Replace context manager init | `_mark_tower_model` -> direct initialization |
| P5 | Import verification | Quick `python3 -c "import ..."` check |
| P6 | Parent `__init__` reimplementation | When parent uses 0.13.0-missing APIs |
| P7 | MoE nested config fix | MoE params live under `text_config` in VL configs |

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill describes starting a network-accessible server on 0.0.0.0, using multiple GPUs, local model files, and trust-remote-code, which materially increases exposure beyond code migration. Exposing an inference service and enabling remote code trust can create a real attack surface or execute untrusted model code if used on unvetted artifacts.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill describes starting a network-accessible server on 0.0.0.0, using multiple GPUs, local model files, and trust-remote-code, which materially increases exposure beyond code migration. Exposing an inference service and enabling remote code trust can create a real attack surface or execute untrusted model code if used on unvetted artifacts.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill describes starting a network-accessible server on 0.0.0.0, using multiple GPUs, local model files, and trust-remote-code, which materially increases exposure beyond code migration. Exposing an inference service and enabling remote code trust can create a real attack surface or execute untrusted model code if used on unvetted artifacts.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill describes starting a network-accessible server on 0.0.0.0, using multiple GPUs, local model files, and trust-remote-code, which materially increases exposure beyond code migration. Exposing an inference service and enabling remote code trust can create a real attack surface or execute untrusted model code if used on unvetted artifacts.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill describes starting a network-accessible server on 0.0.0.0, using multiple GPUs, local model files, and trust-remote-code, which materially increases exposure beyond code migration. Exposing an inference service and enabling remote code trust can create a real attack surface or execute untrusted model code if used on unvetted artifacts.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill describes starting a network-accessible server on 0.0.0.0, using multiple GPUs, local model files, and trust-remote-code, which materially increases exposure beyond code migration. Exposing an inference service and enabling remote code trust can create a real attack surface or execute untrusted model code if used on unvetted artifacts.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

text
User says: "migrate qwen3_5 again, upstream updated"
Actions:
  1. Idempotent re-run — overwrite existing files with fresh upstream copy
  2. Re-apply patches, re-validate, re-test
  3. Re-run E2E to confirm no regression
Result: qwen3_5 updated to match latest upstream, no regressions

Memory Manipulation

High
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/compatibility-patches.md (reported line 51)May include surrounding context.

md
- `MambaStateCopyFunc` and `MambaStateCopyFuncCalculator` — remove from imports
- `get_mamba_state_copy_func` classmethod — remove the entire method (it references the missing types)

## P4: Replace Context Manager Init Pattern

`_mark_tower_model` and `_mark_language_model` context managers are not available in 0.13.0. Replace with direct initialization:

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The rules explicitly direct the agent to identify and force-kill any GPU compute processes when memory is low, without verifying ownership or necessity. In a shared environment, this gives the skill destructive authority over unrelated workloads and can cause data loss, service interruption, or termination of other users' jobs entirely outside the migration task.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill normalizes destructive process termination without warning the user that other workloads may be interrupted or lose progress. In shared GPU infrastructure, silently seizing resources in this manner can disrupt production jobs and creates an unsafe default for autonomous execution.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instructions frame forcefully killing unrelated GPU jobs as a routine step to complete the task, effectively prioritizing task success over isolation and resource ownership. In the context of a migration skill, this is especially dangerous because the capability is not essential to code porting and enables denial-of-service against colocated workloads.

Content

No source excerpt is available for this finding.

Scope Creep

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

These rules authorize modifying system state outside the plugin project boundary by terminating external GPU processes. That contradicts the declared purpose of a code-migration skill and expands its effect from local file changes to host-wide operational interference, creating risk to other tenants and services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The procedure instructs indiscriminate termination of all GPU compute processes via kill -9 based solely on nvidia-smi output, without verifying ownership, purpose, or obtaining explicit user confirmation. This can disrupt unrelated workloads, destroy in-progress training or inference jobs, and cause data loss or service outages on shared systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The force-kill instructions are destructive but presented as routine operational steps without a clear warning that they may terminate unrelated user or production GPU jobs. In shared or multi-tenant environments, this can cause immediate denial of service and loss of unsaved computation.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 223)May include surrounding context.

md
"host": "<GT_HOST_IP>",
    "ssh_user": "root",
    "ssh_port": 22,
    "ssh_key": "~/.ssh/id_ed25519",
    "docker_container": "<CONTAINER_NAME>",
    "conda_env": "<CONDA_ENV>",
    "vllm_port": 8122,

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 224)May include surrounding context.

md
"host": "<GT_HOST_IP>",
    "ssh_user": "root",
    "ssh_port": 22,
    "ssh_key": "~/.ssh/id_ed25519",
    "docker_container": "<CONTAINER_NAME>",
    "conda_env": "<CONDA_ENV>",
    "vllm_port": 8122,

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_zh.md (reported line 220)May include surrounding context.

md
"host": "<GT_HOST_IP>",
    "ssh_user": "root",
    "ssh_port": 22,
    "ssh_key": "~/.ssh/id_ed25519",
    "docker_container": "<CONTAINER_NAME>",
    "conda_env": "<CONDA_ENV>",
    "vllm_port": 8122,

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_zh.md (reported line 221)May include surrounding context.

md
"host": "<GT_HOST_IP>",
    "ssh_user": "root",
    "ssh_port": 22,
    "ssh_key": "~/.ssh/id_ed25519",
    "docker_container": "<CONTAINER_NAME>",
    "conda_env": "<CONDA_ENV>",
    "vllm_port": 8122,

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/procedure.md (reported line 282)May include surrounding context.

md
"host": "<GT_HOST_IP>",
    "ssh_user": "root",
    "ssh_port": 22,
    "ssh_key": "~/.ssh/id_ed25519",
    "docker_container": "<CONTAINER_NAME>",
    "conda_env": "<CONDA_ENV>",
    "vllm_port": 8122,

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/procedure.md (reported line 284)May include surrounding context.

md
"host": "<GT_HOST_IP>",
    "ssh_user": "root",
    "ssh_port": 22,
    "ssh_key": "~/.ssh/id_ed25519",
    "docker_container": "<CONTAINER_NAME>",
    "conda_env": "<CONDA_ENV>",
    "vllm_port": 8122,

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/e2e_config.template.json (reported line 7)May include surrounding context.

json
"host": "<GT_HOST_IP>",
    "ssh_user": "root",
    "ssh_port": 22,
    "ssh_key": "~/.ssh/id_ed25519",
    "docker_container": "<CONTAINER_NAME>",
    "conda_env": "<CONDA_ENV>",
    "vllm_port": 8122,

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/e2e_remote_serve.sh (reported line 23)May include surrounding context.

sh
"host": "<GT_HOST_IP>",
    "ssh_user": "root",
    "ssh_port": 22,
    "ssh_key": "~/.ssh/id_ed25519",
    "docker_container": "<CONTAINER_NAME>",
    "conda_env": "<CONDA_ENV>",
    "vllm_port": 8122,

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The script provides direct shell-based remote execution over SSH, including process kill, docker exec, and background service start operations, but this capability is not reflected in the declared purpose of a model-migration skill. In an agent context, undeclared shell access materially increases the blast radius because a caller can trigger powerful host actions on a remote machine.

Content

No source excerpt is available for this finding.