ClawHub
Back to skill

Security audit

TurboQuant+ KV Cache Compression

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local LLM performance guide, but it asks users to build mutable third-party native code and run a privileged system-tuning command without enough safety guidance.

Install only if you are comfortable building and running the referenced third-party fork. Prefer pinning a reviewed commit or verified release, build in a least-privileged environment, and do not run the sudo sysctl command unless you understand how to restore the previous GPU memory setting.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
README.md:7
Finding

Unpinned Third-Party Source Is Downloaded, Compiled, and Executed

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 7-12
Vulnerability Type: Remote payload retrieval through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash
# Install the llama.cpp TurboQuant fork
git clone https://github.com/TheTom/llama-cpp-turboquant.git
cd llama-cpp-turboquant
cmake -B build -DGGML_METAL=ON && cmake --build build --config Release

# Run with turbo4 (best quality/compression balance)
./build/bin/llama-server -m model.gguf --cache-type-k turbo4 --cache-type-v turbo4 -fa 1

Technical Analysis

The setup instructions clone the current default branch of an externally controlled GitHub repository without pinning a reviewed commit, verifying a signed release, or checking a cryptographic digest. They then instruct the user to compile and execute the retrieved source.

Consequently, the effective executable payload can change after this skill package has been reviewed. Compromise of the repository, its maintainer account, or its upstream development process could cause future users to compile attacker-controlled code. The package's assertion that it has no dependencies is also incomplete because its advertised functionality relies on this external fork.

The primary classification is remote payload retrieval and execution because mutable external code is explicitly fetched and run. It also creates a third-party supply-chain risk.

Attack Path

  1. An attacker compromises the referenced repository, its maintainer account, or another component of its source-control workflow.
  2. The attacker inserts malicious source code into the repository's default branch.
  3. A user follows the documented Quick Start procedure and runs the unpinned git clone.
  4. The user compiles the downloaded source with CMake.
  5. The user starts the resulting llama-server binary.
  6. The malicious payload executes with the operating-system privileges of that user.

Impact Assessment

Successful exploitation ...[truncated 692 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the repository to a specific, reviewed full commit hash rather than relying on its mutable default branch.
  2. Prefer a signed release from a verified publisher and document how users must validate the signature.
  3. Publish an expected SHA-256 or stronger digest for downloaded source archives or binaries and require verification before building or running them.
  4. Record the external fork as an explicit dependency instead of declaring that the project has no dependencies.
  5. Maintain a documented review process for every dependency revision and update the pinned reference only after security review.
  6. Recommend building and initially testing the component in an isolated, least-privileged environment without sensitive credentials or writable access to important files.
  7. If reproducible builds are available, publish build provenance and instructions for comparing locally generated artifacts against trusted outputs.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

sudo sysctl iogpu.wired_limit_mb=117964

Then run with turbo3 for maximum context

llama-server -m Llama-70B-Q4_K_M.gguf --cache-type-k turbo3 --cache-type-v turbo3 -c 65536 -fa 1

text

### Recommended Configs by Scenario

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to run a privileged sudo sysctl iogpu.wired_limit_mb=117964 command to raise the GPU wired memory limit, but it does not explain that this requires administrator privileges, changes a system-wide kernel parameter, or may reduce system stability and memory headroom. In a copy-paste workflow, this can lead users to execute sensitive commands without understanding the consequences, which is a real safety issue even though the apparent goal is performance tuning rather than compromise.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

The documented use of sudo asks the user to execute a privileged command, which raises the risk of accidental misuse and normalizes running setup instructions as root. Although the command is not overtly malicious, it alters a low-level system setting and could negatively affect system behavior or encourage unsafe trust in similar copy-pasted privileged commands.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

bash
# Set to 90% of 128GB
sudo sysctl iogpu.wired_limit_mb=117964

# Then run with turbo3 for maximum context
llama-server -m Llama-70B-Q4_K_M.gguf --cache-type-k turbo3 --cache-type-v turbo3 -c 65536 -fa 1