Security audit
Security checks for vulnerabilities and agentic risk
This skill openly changes generated install and download commands to use China-based mirrors, so it should only be enabled by users who want that routing.
Install this only if you intentionally want your agent to prefer the listed China-based mirrors for package downloads. Review generated install commands before running them when dependency provenance matters, and explicitly specify an upstream source when you do not want mirror substitution.
The skill is presented as a China-specific solution and states that AI-generated commands should automatically add domestic mirror source parameters. This imposes a locale-specific behavior by default, but the README does not indicate user opt-in, language/region selection, or a clearly scoped regional-compliance justification.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
These commands establish lasting integration with both ~/.agents/skills and optionally ~/.claude/skills, which extends the skill's influence beyond a one-time run. While likely intended for convenience, persistent registration is security-relevant because any future changes to the linked repository are automatically trusted by the agent runtime.
git clone https://github.com/xiaomiba0904/china-mirror-skill.git
# 安装到 Claude Code skills 目录
mkdir -p ~/.agents/skills
ln -s $(pwd)/china-mirror-skill ~/.agents/skills/china-mirror
# 可选：创建符号链接到 .claude/skills
These commands establish lasting integration with both ~/.agents/skills and optionally ~/.claude/skills, which extends the skill's influence beyond a one-time run. While likely intended for convenience, persistent registration is security-relevant because any future changes to the linked repository are automatically trusted by the agent runtime.
git clone https://github.com/xiaomiba0904/china-mirror-skill.git
# 安装到 Claude Code skills 目录
mkdir -p ~/.agents/skills
ln -s $(pwd)/china-mirror-skill ~/.agents/skills/china-mirror
# 可选:创建符号链接到 .claude/skills
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.agents/skills ln -s $(pwd)/china-mirror-skill ~/.agents/skills/china-mirror
mkdir -p ~/.claude/skills ln -s ~/.agents/skills/china-mirror ~/.claude/skills/china-mirror
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
The skill hard-codes a China-specific mirror policy in its metadata/description without any user opt-in, locale check, or disclosure that generated install commands will be rewritten to use alternate registries. This can silently redirect package downloads away from official upstream sources, affecting supply-chain trust, reproducibility, compliance, and reliability for users outside the intended region.
The rule requiring automatic use of domestic mirrors for any command that may trigger a download creates an undisclosed regional default that overrides normal package source expectations. Because the skill applies this broadly, including indirect download scenarios, it increases the chance of silently changing dependency provenance and causing users to execute commands against unintended registries or mirrors.
The description says the skill will automatically add mirror parameters whenever the AI generates package download commands, which is an overly broad activation condition. Automatically rewriting install commands can silently redirect users to alternate infrastructure, reducing user awareness and weakening trust boundaries even if the mirrors are described as reputable.
The description presents China-specific mirror use as default behavior without mentioning user choice, consent, or fallback to upstream sources. In a skill that influences software installation commands, forcing region-specific mirrors can cause users to fetch packages from unintended sources, with supply-chain and integrity risks if the substitution is not explicitly requested and reviewable.
No suspicious patterns detected.