ClawHub
Back to skill

Security audit

flutter-cn-setup

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for setting up Flutter in China-region macOS environments, but it makes persistent shell-profile changes and recommends mutable network installer execution without enough guardrails.

Install only if you specifically want a China-region Flutter setup on macOS. Review the bootstrap script before running it, avoid passing untrusted environment variables, inspect any changes to ~/.zshrc, and treat the Homebrew installer and sudo Xcode commands as manual steps that require your explicit trust.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/bootstrap-flutter-cn.sh:37
Finding

Unverified Mutable Homebrew Installer Is Recommended for Direct Shell Execution

Content
View full analysis

Vulnerability Details

File Location: scripts/bootstrap-flutter-cn.sh, lines 37–45
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code

bash
install_base_tools() {
  if ! has_cmd brew; then
    cat <<'EOF'
Homebrew is not installed.
Install it first:
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
Then re-run this script.
EOF
    exit 1
  fi

Technical Analysis

When Homebrew is unavailable, the bootstrap script prints a command that retrieves a shell script from a mutable HEAD reference and immediately passes the downloaded content to Bash. The bootstrap script does not execute the command automatically, but it explicitly instructs the user to execute it as a prerequisite.

The URL belongs to the official Homebrew GitHub organization rather than a personal code-hosting or pastebin account. This reduces source-impersonation risk, but it does not provide payload immutability or integrity verification. The command neither pins a reviewed commit nor validates a cryptographic checksum or signature before execution.

Consequently, the effective code executed by the user can change after this Skill has been reviewed. Compromise of the upstream repository, maintainer account, distribution path, or another trusted delivery component could substitute arbitrary shell commands. The upstream installer may also request elevated privileges as part of installing Homebrew.

Attack Path

  1. A user invokes the bootstrap script on a macOS system without Homebrew.
  2. The script prints the curl-to-Bash command and directs the user to run it.
  3. The user retrieves the current contents of the mutable HEAD/install.sh resource.
  4. The response is passed directly to /bin/bash without being saved, reviewed, pinned, or cryptographically verified.
  5. If the upstream resource or delivery chain ...[truncated 884 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell.
  • Prefer an authenticated, platform-supported installation mechanism for Homebrew.
  • If the installer script must be used, pin its URL to a reviewed immutable commit instead of HEAD.
  • Download the installer to a local file before execution.
  • Verify the file using a cryptographic signature or checksum obtained through an independent trusted channel.
  • Display the downloaded file path and require explicit user confirmation after verification.
  • Clearly disclose whether the installer will request administrative privileges and which system locations it will modify.
  • Consider stopping with a link to official installation documentation rather than embedding a directly executable command.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bootstrap-flutter-cn.sh:5
Finding

Unsanitized Configuration Values Are Persisted as Shell Code

Content
View full analysis

Vulnerability Details

File Location: scripts/bootstrap-flutter-cn.sh, lines 5–9 and 63–75
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

bash
FLUTTER_DIR="${FLUTTER_DIR:-$HOME/development/flutter}"
SHELL_PROFILE="${SHELL_PROFILE:-$HOME/.zshrc}"
NEED_IOS="${NEED_IOS:-yes}" # yes|no
MIRROR_PUB_URL="${MIRROR_PUB_URL:-https://pub.flutter-io.cn}"
MIRROR_STORAGE_URL="${MIRROR_STORAGE_URL:-https://storage.flutter-io.cn}"

configure_shell_profile() {
  log "Configuring mirrors and PATH in $SHELL_PROFILE"
  append_if_missing "# Flutter CN mirrors" "$SHELL_PROFILE"
  append_if_missing "export PUB_HOSTED_URL=$MIRROR_PUB_URL" "$SHELL_PROFILE"
  append_if_missing "export FLUTTER_STORAGE_BASE_URL=$MIRROR_STORAGE_URL" "$SHELL_PROFILE"
  append_if_missing "# Flutter SDK PATH" "$SHELL_PROFILE"
  append_if_missing "export PATH=\"\$PATH:$FLUTTER_DIR/bin\"" "$SHELL_PROFILE"

  # Also export in current shell for immediate usage.
  export PUB_HOSTED_URL="$MIRROR_PUB_URL"
  export FLUTTER_STORAGE_BASE_URL="$MIRROR_STORAGE_URL"
  export PATH="$PATH:$FLUTTER_DIR/bin"
}

The affected values are written through the following helper:

bash
append_if_missing() {
  local line="$1"
  local file="$2"
  if [[ ! -f "$file" ]]; then
    touch "$file"
  fi
  if ! grep -Fqx "$line" "$file"; then
    printf "%s\n" "$line" >> "$file"
  fi
}

Technical Analysis

MIRROR_PUB_URL, MIRROR_STORAGE_URL, FLUTTER_DIR, and SHELL_PROFILE are caller-controlled environment variables. The script interpolates the first three values into lines that are persisted in a shell startup file without validating their syntax or encoding them as safe shell literals.

A value containing a newline can append an additional shell statement. Quotes and shell metacharacters can also alter the intended assignment. In particular, FLUTTER_DIR is inserted ...[truncated 2098 chars]

Remediation
View remediation

Remediation Suggestions

  • Reject carriage returns, newlines, NUL bytes, and unexpected shell metacharacters in all values written to a shell profile.
  • Validate mirror values as HTTPS URLs and use an allowlist of expected origins unless the user explicitly approves a different host.
  • Serialize values as shell-safe literals rather than performing direct interpolation. For Bash-compatible output, generate assignments using printf '%q'.
  • Validate FLUTTER_DIR as a filesystem path and safely quote the complete persisted value.
  • Canonicalize and restrict SHELL_PROFILE to an explicitly approved user shell configuration file.
  • Refuse symlinked or non-user-owned profile destinations where appropriate.
  • Show the exact proposed profile changes and request confirmation before persisting them.
  • Prefer a dedicated, clearly delimited configuration block that can be safely updated or removed instead of appending independent lines.
  • Add regression tests using values containing newlines, quotes, command substitutions, spaces, and shell metacharacters to confirm that they cannot create executable profile content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
bash scripts/validate-flutter-cn.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
bash scripts/validate-flutter-cn.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md
bash scripts/validate-flutter-cn.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md
bash scripts/validate-flutter-cn.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md
bash scripts/validate-flutter-cn.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
bash scripts/validate-flutter-cn.sh

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs execution of multiple shell commands and bundled scripts, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls because an agent may invoke shell capability more broadly than the user or platform expects, especially when the skill also performs installation, file modification, and validation steps.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

This finding reflects the same persistent behavior tied to installing Flutter under the user's home directory and then updating shell startup files so it is automatically trusted on future sessions. In a setup skill, persistence is contextually expected, but it still expands blast radius because a bad checkout, replaced binary, or unreviewed profile entry remains active until manually removed.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

建议使用 git 安装（便于后续升级）：

bash
mkdir -p ~/development
git clone https://github.com/flutter/flutter.git -b stable ~/development/flutter

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

This finding reflects the same persistent behavior tied to installing Flutter under the user's home directory and then updating shell startup files so it is automatically trusted on future sessions. In a setup skill, persistence is contextually expected, but it still expands blast radius because a bad checkout, replaced binary, or unreviewed profile entry remains active until manually removed.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

建议使用 git 安装(便于后续升级):

bash
mkdir -p ~/development
git clone https://github.com/flutter/flutter.git -b stable ~/development/flutter

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill is hard-scoped to China-region mirrors and network assumptions without presenting them as an explicit user choice. This can lead to configuration of alternate package sources or mirrors that may be inappropriate for the user's environment, with potential trust, compliance, or supply-chain implications if users are routed to different infrastructure by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples instruct users to run setup scripts and later a privileged command, but do not warn that these actions will modify the system, install software, and may require elevated permissions. In an agent-driven context, users may copy or approve commands without understanding the scope of changes, increasing the risk of unsafe execution or unintended system modification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

The example recommends a sudo command without contextual warning or least-privilege guidance. Even though xcodebuild -runFirstLaunch is a legitimate setup step, normalizing privileged execution in examples can cause users or agents to run administrator-level commands without validation, which is risky if commands are altered, misunderstood, or reused in other contexts.

Content

Scanner excerpt · examples.md (reported line 34)May include surrounding context.

md
下一步
- flutter doctor --android-licenses
- sudo xcodebuild -runFirstLaunch

最终验收
- 环境接近可用，完成上述两步后重新执行 validator。

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bootstrap-flutter-cn.sh (reported line 42)May include surrounding context.

sh
cat <<'EOF'
Homebrew is not installed.
Install it first:
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
Then re-run this script.
EOF
    exit 1

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md
cat <<'EOF'
1) Install Xcode from App Store.
2) Run:
   sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
   sudo xcodebuild -runFirstLaunch
3) Install CocoaPods:
   brew install cocoapods

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md
cat <<'EOF'
1) Install Xcode from App Store.
2) Run:
   sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
   sudo xcodebuild -runFirstLaunch
3) Install CocoaPods:
   brew install cocoapods

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap-flutter-cn.sh (reported line 111)May include surrounding context.

sh
cat <<'EOF'
1) Install Xcode from App Store.
2) Run:
   sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
   sudo xcodebuild -runFirstLaunch
3) Install CocoaPods:
   brew install cocoapods

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap-flutter-cn.sh (reported line 112)May include surrounding context.

sh
cat <<'EOF'
1) Install Xcode from App Store.
2) Run:
   sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
   sudo xcodebuild -runFirstLaunch
3) Install CocoaPods:
   brew install cocoapods

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script validates that PUB_HOSTED_URL and FLUTTER_STORAGE_BASE_URL must match China-specific endpoints, effectively enforcing a locale-specific configuration. This is a natural-language policy concern because the file name and messages do not indicate any user opt-in or explicit justification for restricting users to a specific regional mirror.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The document title and description position the skill specifically as a Chinese-network/Chinese-context Flutter setup workflow (e.g. "Flutter CN Skill"), but there is no natural-language indication that users can choose another language or locale context. Under the policy, forcing a specific language/locale without opt-in is a reportable issue unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The title and description present the skill as a China-focused troubleshooting manual entirely in Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

处理

bash
sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
sudo xcodebuild -license accept
sudo xcodebuild -runFirstLaunch
flutter doctor -v

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

处理

bash
sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
sudo xcodebuild -license accept
sudo xcodebuild -runFirstLaunch
flutter doctor -v

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 113)May include surrounding context.

处理

bash
sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
sudo xcodebuild -license accept
sudo xcodebuild -runFirstLaunch
flutter doctor -v

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 114)May include surrounding context.

处理

bash
sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
sudo xcodebuild -license accept
sudo xcodebuild -runFirstLaunch
flutter doctor -v

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 115)May include surrounding context.

处理

bash
sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
sudo xcodebuild -license accept
sudo xcodebuild -runFirstLaunch
flutter doctor -v