TokenBroker — 统一AI API网关

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 0.1.0

Overview

The skill’s TokenBroker purpose is understandable, but its installer can run unaudited external code and register a persistent local service with too little user control.

Review this carefully before installing. It may start and persist a local TokenBroker service, modify ~/supervisord.conf, install Node dependencies from an external project directory, and route LLM calls through a broker that records usage. Only use it if you trust the external token-broker project and are comfortable auditing or manually controlling the Supervisor and npm steps.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: scripts/init.sh:42
• Finding: Persistent execution of code outside the audited Skill package<![CDATA[ ## Vulnerability Details **File Location**: `scripts/init.sh`, lines 42-76 **Vulnerability Type**: Persistent service registration **Risk Level**: High ### Vulnerable Code ```bash # 4. 通过 Supervisor 注册（如果已安装 Supervisor） if command -v python3 &> /dev/null && python3 -c "import supervisor" 2>/dev/null; then SUPERVISOR_CONF="${HOME}/supervisord.conf" if [ -f "${SUPERVISOR_CONF}" ]; then if ! grep -q "token-broker" "${SUPERVISOR_CONF}" 2>/dev/null; then warn "未在 Supervisor 中找到 token-broker，尝试注册..." # 尝试通过 supervisord 提供的 rpc 接口添加 echo " [program:token-broker] command=npx ts-node ${BROKER_DIR}/src/server.ts directory=${BROKER_DIR} autostart=true autorestart=true startsecs=5 startretries=10 stopwaitsecs=5 killasgroup=true stopsignal=TERM stdout_logfile=/dev/stdout stdout_logfile_maxbytes=0 stderr_logfile=/dev/stderr stderr_logfile_maxbytes=0 environment=BROKER_PORT=${BROKER_PORT},NODE_ENV=production" >> "${SUPERVISOR_CONF}" info "已追加到 Supervisor 配置" python3 -m supervisor.supervisorctl -c "${SUPERVISOR_CONF}" reread 2>/dev/null || true python3 -m supervisor.supervisorctl -c "${SUPERVISOR_CONF}" update 2>/dev/null || true sleep 2 else info "Supervisor 中已配置 TokenBroker" python3 -m supervisor.supervisorctl -c "${SUPERVISOR_CONF}" start token-broker 2>/dev/null || true sleep 2 fi fi fi ``` ### Technical Analysis The initialization script appends a new program definition to the user's persistent Supervisor configuration. The definition enables both `autostart` and `autorestart`, causing `${BROKER_DIR}/src/server.ts` to execute beyond the lifetime of the installer and to restart automatically after failure or a Supervisor restart. The executed broker source is located in the sibling directory `../../production-system/token-broker` rather than inside the audited Skill. That source code is not included in the project under review, so its behavior and integrity cannot be verified as par ...[truncated 1425 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not create a persistent Supervisor service by default. Require explicit, informed user consent before modifying startup configuration. 2. Keep executable broker code inside a reviewed, versioned package rather than resolving it from a sibling directory. 3. Verify the broker artifact using a cryptographic digest or signature before registering or executing it. 4. Invoke a pinned executable through an absolute path instead of relying on `npx` and ambient package resolution. 5. Generate a dedicated Supervisor configuration file rather than appending text to a shared `~/supervisord.conf`. 6. Display the exact configuration and executable path before installation and provide an explicit uninstall operation that stops the service and removes its configuration. 7. Run the broker under a dedicated, least-privileged account with narrowly scoped filesystem and network permissions where supported. 8. Do not suppress failures from `supervisorctl`; abort and report an actionable error if registration cannot be verified. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/init.sh:36
• Finding: Unsafe installation and execution of unaudited third-party dependencies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/init.sh`, lines 36-56 **Vulnerability Type**: Dependency and executable supply-chain exposure **Risk Level**: High ### Vulnerable Code ```bash # 3. 检查依赖是否安装 if [ ! -d "${BROKER_DIR}/node_modules" ]; then info "安装 Node.js 依赖..." cd "${BROKER_DIR}" && npm install 2>&1 | tail -1 fi # 4. 通过 Supervisor 注册（如果已安装 Supervisor） if command -v python3 &> /dev/null && python3 -c "import supervisor" 2>/dev/null; then SUPERVISOR_CONF="${HOME}/supervisord.conf" if [ -f "${SUPERVISOR_CONF}" ]; then if ! grep -q "token-broker" "${SUPERVISOR_CONF}" 2>/dev/null; then warn "未在 Supervisor 中找到 token-broker，尝试注册..." # 尝试通过 supervisord 提供的 rpc 接口添加 echo " [program:token-broker] command=npx ts-node ${BROKER_DIR}/src/server.ts ``` ### Technical Analysis The script runs `npm install` in an external directory whose package manifest, lockfile, source code, and dependency integrity information are absent from the audited project. Standard `npm install` behavior may retrieve packages from configured registries and execute dependency lifecycle hooks such as `preinstall`, `install`, and `postinstall`. The generated Supervisor command subsequently uses `npx ts-node`. Depending on the external project's installed packages and npm configuration, `npx` may resolve an executable from local dependencies, the user's environment, or a package registry. The Skill does not pin or verify the executable being launched. Checking only whether `node_modules` exists is not an integrity check. A preexisting but attacker-modified `node_modules` directory bypasses installation and is then trusted during execution. ### Attack Path 1. An attacker compromises a dependency referenced by the external broker project, modifies its package metadata or lockfile, controls the configured npm registry, or plants a malicious local package or executable. 2. The initializer finds that `${BROKER_DIR}/node_modules` does not exist ...[truncated 1101 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the broker source, `package.json`, and a reviewed lockfile within the auditable distribution. 2. Use `npm ci` with a committed lockfile instead of unconstrained `npm install`. 3. Pin exact package versions and validate registry integrity metadata. 4. Use `npm ci --ignore-scripts` when dependency lifecycle scripts are not strictly required. Explicitly audit and invoke any required build steps. 5. Configure an approved npm registry and reject unexpected package sources, Git dependencies, local paths, and mutable URLs. 6. Verify the external project's ownership, canonical path, permissions, source digest, and dependency tree before executing it. 7. Invoke a verified local executable through an absolute path, such as a pinned binary under the broker project, rather than `npx`. 8. Treat the existence of `node_modules` as insufficient. Perform integrity verification against the lockfile before every launch. 9. Run package installation and the broker in a restricted environment without unnecessary credentials or filesystem access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/init.sh:16
• Finding: Supervisor configuration injection through unvalidated BROKER_PORT<![CDATA[ ## Vulnerability Details **File Location**: `scripts/init.sh`, lines 16 and 69 **Vulnerability Type**: Configuration injection **Risk Level**: High ### Vulnerable Code ```bash BROKER_PORT=${BROKER_PORT:-8766} ``` The value is later interpolated directly into a multiline Supervisor configuration: ```bash environment=BROKER_PORT=${BROKER_PORT},NODE_ENV=production" >> "${SUPERVISOR_CONF}" ``` ### Technical Analysis `BROKER_PORT` is accepted from the process environment without validating that it contains only a valid TCP port number. Its value is directly inserted into text appended to `~/supervisord.conf`. Shell quoting around `${BROKER_PORT}` prevents ordinary shell word splitting at expansion time, but it does not make the value safe for the Supervisor configuration format. An environment value containing newline characters or configuration syntax can terminate the intended directive and inject additional Supervisor directives or sections. The script immediately invokes `supervisorctl reread` and `supervisorctl update` after writing the configuration, which can activate injected content. Errors from these commands are suppressed with `2>/dev/null || true`, reducing the likelihood that malformed or partially applied configuration will be noticed. ### Attack Path 1. An attacker gains the ability to influence the environment used to launch the initializer, such as through a wrapper script, automated installation environment, inherited process configuration, or manipulated deployment settings. 2. The attacker supplies a `BROKER_PORT` value containing a newline followed by attacker-selected Supervisor configuration directives. 3. The initial health request fails or is rejected, allowing execution to continue to the registration block. 4. The initializer inserts the unescaped value into `~/supervisord.conf`. 5. The appended value creates or modifies a Supervisor program definition containing an attacker-selected command. 6. `supervisorctl reread` a ...[truncated 657 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `BROKER_PORT` immediately after reading it: ```bash BROKER_PORT="${BROKER_PORT:-8766}" if [[ ! "$BROKER_PORT" =~ ^[0-9]{1,5}$ ]] || (( BROKER_PORT < 1 || BROKER_PORT > 65535 )); then error "BROKER_PORT must be an integer between 1 and 65535" exit 1 fi ``` 2. Explicitly reject newline characters, carriage returns, control characters, commas, percent signs, quotes, and other syntax not required for a numeric port. 3. Avoid generating configuration through an interpolated multiline `echo`. Use a fixed template and substitute only strictly validated values. 4. Write a dedicated temporary configuration using secure file creation, validate it with Supervisor tooling, and atomically move it into place. 5. Set restrictive permissions on generated configuration files. 6. Do not suppress `supervisorctl` errors. Abort if configuration validation, rereading, or activation fails. 7. Verify the generated configuration after writing it and ensure that only the expected `token-broker` section and directives are present. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that installation will automatically detect and start a backend service and later says it configures the service under Supervisor, but it does not clearly warn the user up front that installing the skill changes local runtime state and persistence. Silent service startup and supervision changes reduce informed consent and can surprise users with a long-running local process.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The skill instructs operators to run `npx ts-node src/server.ts` without pinning an exact package/version, which can pull or rely on whatever resolver state is present at execution time. In a local privileged install/startup path, this creates supply-chain and reproducibility risk because an unexpected or compromised dependency/tooling version could execute arbitrary code.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises automatic routing of LLM requests, API invocation, and usage/billing statistics recording, but does not disclose what prompt data, metadata, or identifiers are transmitted, stored, or retained. Because this feature intermediates all AI calls, missing privacy and data-handling warnings can expose sensitive user content or operational metadata without informed consent.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The header presents the file as a simple installation/initialization script, but the body modifies persistent Supervisor configuration and attempts to start a backend service automatically. This mismatch reduces informed consent and can cause users to run a script that establishes persistence or changes system behavior beyond what they reasonably expect.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "╚══════════════════════════════════════╝"

# 1. 检测后端是否已在运行
if curl -s --connect-timeout 2 "${BROKER_URL}/api/health" > /dev/null 2>&1; then
  info "TokenBroker 后端服务已在运行 (端口 ${BROKER_PORT})"
  exit 0
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script appends a new `[program:token-broker]` block to `${HOME}/supervisord.conf` without confirmation, review, or backup, thereby persisting a service that will auto-start and auto-restart. Any script that silently changes a user's process supervisor configuration can create unwanted persistence and makes abuse significantly more dangerous if the referenced service or path is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The script's comments and all user-visible status messages are in Chinese, which imposes a specific language on users without opt-in. Under the stated policy, locale-specific behavior should either offer a language choice or be explicitly justified as region-specific.

Static analysis

No suspicious patterns detected.