Dirextalk Deployer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.0.1

Overview

This deployment skill is coherent, but it asks for very broad AWS authority, installs mutable latest packages, stores tokens locally, and enables persistent services with permissive agent defaults.

Review this carefully before installing. Use a least-privilege AWS role instead of root or AdministratorAccess keys, pin reviewed package versions instead of @latest, avoid yolo/permissive agent mode unless you explicitly want it, and protect or rotate all files under ~/.dirextalk/nodes/<service_id>/ that contain tokens or sessions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:30

Finding

Unpinned Packages Are Retrieved and Executed from Mutable npm Release Tags

Content

View full analysis

``` ```text # SKILL.md:278-280 The supported local bridge is `dirextalk-connect`, installed from `dirextalk-connect@latest` by default or built from `https://github.com/YingSuiAI/dirextalk-connect.git`. ``` ```text # SKILL.md:304-307 `DIREXTALK_AGENT_INSTALL=auto` installs `dirextalk-connect@latest` into the current service directory, not into the npm global prefix, unless explicit binary/command overrides are set. ``` ```text # references/agent-targets.md:157-161 - `DIREXTALK_AGENT_INSTALL=auto` (default): refresh `dirextalk-connect@latest` under `~/.dirextalk/nodes//dirextalk-connect` ... and installs or refreshes the service-scoped `dirextalk-connect daemon install ... --force` ``` ### Technical Analysis The Skill requires a freshness attempt using the mutable npm `latest` tag before sensitive operations, including deployment, verification, teardown, and installation. It also installs `dirextalk-connect@latest` by default and then persists that package as a local daemon. An npm tag is not an immutable security boundary. The package version and effective executable payload can change after this Skill has been reviewed. The audited documentation does not require an exact package version, npm integrity value, signature, provenance attestation, or prior review of the resolved package. This is particularly sensitive because the resulting processes may operate while AWS credentials, local bearer tokens, agent configurations, and cloud resource a ...[truncated 1586 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:107

Finding

Deployment Guidance Encourages Root or Full-Administrator AWS Credentials

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Error

• Location: references/state-machine.md:23

Finding

Deployment Installs Persistent Root-Owned and User-Level Services

Content

View full analysis

/dirextalk-connect/config.toml --service-name --force` ``` ### Technical Analysis The deployment establishes two forms of cross-session persistence: - A root-owned server-side `systemd` updater service with a daily scheduled timer. - A local service-scoped `dirextalk-connect` daemon installed with `--force`. Persistence is related to providing a continuously available server and bridge, but the updater's root privileges and recurring release discovery create a high-value execution channel. The local daemon compounds the dependency risk because it is installed from the mutable `latest` package tag by default. The documentation states that the updater binary is pinned and SHA-256 verified, which is a useful control. However, the implementation scripts are absent from the submitted project, so checksum enforcement, systemd hardening, release authenticity, privilege dropping, update a ...[truncated 1380 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/agent-targets.md:81

Finding

Bearer Tokens and Optional Third-Party API Keys Are Stored in Plaintext Configuration Files

Content

View full analysis

` - Eight-digit App initialization code: current backend `password` value - Local service credentials: `~/.dirextalk/nodes//credentials.json` - MCP endpoint is held by `state.json` and `dirextalk-connect/config.toml` ``` ```toml # references/agent-targets.md:81-99 [speech] enabled = true provider = "openai" language = "zh" [speech.openai] api_key = "" [[projects]] name = "" admin_from = "@owner:" [projects.agent.options] work_dir = "" cmd = "" mcp_url = "https:///mcp" mcp_server_name = "dirextalk-" mcp_agent_token = "" mcp_node_id = "" ``` ### Technical Analysis The Skill's functionality legitimately requires a local authentication mechanism for the bridge. Therefore, accessing a service-scoped credential path does not inherently exceed the declared functional scope. The security weakness is that bearer tokens and an optional speech-provider API key are documented as values in ordinary JSON or TOML files. The reviewed files do not mandate: - Owner-only directory and file permissions. - Atomic secure file creation. - Symlink and hard-link protections. - OS credential-store integration. - Encryption at rest. - Backup and indexing exclusions. - Automated token expiration or rotation. A bearer token grants authority to whoever possesses it. Storing it in a broadly readable file can turn a local information disclosure into remote service impersonation. ### Attack Path 1. S6 writes `credentials.json` and `dirextalk-connect/config.toml` under the user's home directory. 2. The files a ...[truncated 1046 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:340

Finding

Generated Agent Configuration Defaults to Permissive “Yolo” Mode

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

er` and use its CLI to place the skill in the runtime-specific global path from references/agent-targets.md unless the user explicitly asks for a project-local

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

er` and use its CLI to place the skill in the runtime-specific global path from references/agent-targets.md unless the user explicitly asks for a project-local

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 451)May include surrounding context.

md

er` and use its CLI to place the skill in the runtime-specific global path from references/agent-targets.md unless the user explicitly asks for a project-local

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

## Platform Law

Classify every path by consumer before writing it to `state.json`,
`credentials.json`, `dirextalk-connect/config.toml`, docs, or printed commands:

- Remote server paths are Linux paths consumed on EC2, such as `/var/dirextalk-message-server`.
- Deployer execution paths may be POSIX paths inside Bash phases.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 71% confidence

Finding

The skill instructs writing credentials.json under a predictable service-scoped directory in the user's home folder. Although local credential storage is operationally necessary, storing secrets on disk without explicit requirements for encryption, file permissions, lifecycle limits, or OS keychain integration creates a real exposure if the workstation is multi-user, compromised, or backed up/synced insecurely.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

S6 writes service-scoped files under ~/.dirextalk/nodes/<service_id>/:

text

credentials.json
dirextalk-connect/config.toml
mcp/

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.

md

Operation reports are written as redacted `operation-report.json` artifacts.
`scripts/orchestrate.sh report new_deploy` can regenerate a new deployment
report. Reports must not include AWS secrets, access tokens, agent tokens,
Matrix session tokens, or the eight-digit app initialization code. Because user
evidence can contain secrets, confirmation evidence is redacted, including
eight-or-more digit numeric strings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill documents writing sensitive artifacts such as credentials.json and matrix-session.json under a predictable path in the user's home directory. In a deployment/install skill, storing long-lived credentials and session material on disk increases the risk of credential theft by other local processes, backups, or accidental disclosure if file permissions and secret-handling controls are weak.

Content

Scanner excerpt · references/agent-targets.md (reported line 67)May include surrounding context.

S6 writes service-specific files to ~/.dirextalk/nodes/<service_id>/, where service_id is derived from the deployed domain:

text

credentials.json
dirextalk-connect/config.toml
dirextalk-connect/data/
dirextalk-connect/matrix-session.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The document defines a fixed local path for service credentials and indicates that sensitive tokens and configuration are materialized on disk for ongoing runtime use. In the context of a production message server and local MCP/Matrix bridge wiring, compromise of ~/.dirextalk/nodes/<service_id>/credentials.json could let an attacker impersonate the local service, access the deployed endpoint, or pivot into the user's agent runtime.

Content

Scanner excerpt · references/state-machine.md (reported line 32)May include surrounding context.

md

- App 域名: `<domain>`
- 八位 App 初始化码: 后端 `password` 字段的当前值
- 本地服务凭据: `~/.dirextalk/nodes/<service_id>/credentials.json`
- MCP endpoint 由 `state.json` 与 `dirextalk-connect/config.toml` 的当前消费者持有，不再生成无人消费的 `mcp/env`
- dirextalk-connect 配置: `~/.dirextalk/nodes/<service_id>/dirextalk-connect/config.toml`
- MCP 配置目录: `~/.dirextalk/nodes/<service_id>/mcp/`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill requires creating a persistent Matrix session using an agent_token and storing related runtime configuration locally. Persistent session material can be abused if stolen, allowing an attacker to impersonate the agent, access message flows, or interact with the provisioned messaging environment beyond the intended session scope.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

mcp/

text

The dirextalk-connect config must use a direct Matrix config, create the Matrix session
through `agent.matrix_session.create` with `agent_token`, require `@agent:<server>`,
and restrict sync/replies to the real `agent_room_id`. It must not use
MCP credential-file environment variables.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states generated agent options default to mode = "yolo", which commonly implies reduced confirmation/safety checks and more autonomous action. In a deployment skill that provisions AWS resources and handles credentials, enabling an unsafe execution mode by default materially increases the chance of unintended destructive or billable actions without explicit user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example generated configuration sets [speech].language = "zh", which imposes a specific language/locale choice. The file does not indicate that this is optional, user-selected, or limited to a justified region-specific deployment, so it appears to violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/agent-targets.md (reported line 112)May include surrounding context.

share_session_in_channel = true group_reply_all = true auto_join = false auto_verify = false

text

The `[speech]` block is present only when S6 finds a speech-to-text API key from `DIREXTALK_SPEECH_*` or supported provider environment variables. Voice input is not available without STT credentials.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The installation policy explicitly says it will write credentials, configuration, and record state even in skip and recommend flows, and the default auto mode installs a persistent daemon. For a deployer skill, this creates durable local state and session persistence that can outlive the user's immediate task, expanding the attack window if the host is later compromised or if cleanup is incomplete.

Content

Scanner excerpt · references/agent-targets.md (reported line 159)May include surrounding context.

md

## Installation Policy

- `DIREXTALK_AGENT_INSTALL=skip`: write credentials, canonical MCP artifacts, and dirextalk-connect config only.
- `DIREXTALK_AGENT_INSTALL=recommend`: write files, record state, and print the install command.
- `DIREXTALK_AGENT_INSTALL=auto` (default): refresh `dirextalk-connect@latest` under `~/.dirextalk/nodes/<service_id>/dirextalk-connect`, unless explicit binary/command overrides are set. S6 writes short wrappers at `dirextalk-connect/dirextalk-connect(.cmd)`, installs or refreshes the service-scoped `dirextalk-connect daemon install --config ~/.dirextalk/nodes/<service_id>/dirextalk-connect/config.toml --service-name <service_id> --force`, and records dirextalk-connect as installed only after `dirextalk-connect daemon status --service-name <service_id>` reports `Status: Running` and recent daemon logs show `dirextalk-connect is running`. Logs that show agent CLI missing, login/auth/trust failures, ACP startup failures, or agent offline state make S6 fail with `connect_install_status=install_failed`; deploy does not continue to completion until the daemon startup is verified. MCP records `mcp_install_status=not_required` for the HTTP endpoint path.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/state-machine.md (reported line 11)May include surrounding context.

md

- **S1_PREFLIGHT**: 校验 region、Lightsail 套餐和 Lightsail 可用区，然后选择云提供方；不查询 AWS Free Tier 或免费额度使用情况。默认 Lightsail，默认 AZ 是 `<region>a`；如果默认 AZ 不可用则选择同 region 其他可用 Lightsail AZ；如果 Lightsail 当前 region 没有可用套餐或可用区，且用户没有显式强制 Lightsail，则在 S1 记录选择 EC2。EC2 路径会校验默认 VPC、vCPU 配额、Elastic IP 可用配额和 Ubuntu 24.04 amd64 AMI。
- **S2_DOMAIN**: 确认正式长期域名和 Matrix `server_name` 不可逆绑定。
- **S3_PROVISION**: 按 S1 记录的 provider 创建资源。开始创建云资源前解析最新稳定 server GitHub Release、校验 manifest checksum，并在 `state.json.server_release` 固定 version/image/digest/image_ref/manifest_digest，同时记录独立 updater 的 version/commit/SHA-256 pin。Lightsail 路径创建 Ubuntu 24.04 实例、密钥对、静态 IP 和防火墙端口；EC2 创建 Ubuntu 24.04 amd64 实例、密钥对、安全组、Elastic IP 和 50 GiB gp3 root EBS。两条路径的 user-data 都包含 bootstrap；在校验宿主为 Ubuntu 22.04 或 24.04 x86_64 后，bootstrap 直接下载固定 updater Release URL、核对 deployer 固定 SHA-256 并原子安装。S3 只通过 SSH 触发可续跑 bootstrap，不复制二进制。`MESSAGE_SERVER_IMAGE` 只在同时设置 `DIREXTALK_ALLOW_MESSAGE_SERVER_IMAGE_OVERRIDE=1` 的 debug/legacy 部署中可用。
- **LEGACY_ADOPT**: 不属于普通 S3 resume。仅 `scripts/adopt-legacy-node.sh` 在 dry-run 证明固定 d1 v0.15.2/digest/Compose/host-Caddy 拓扑并收到精确确认后，写入 `server_release.source=legacy_adopted`，生成 `/var/dirextalk-message-server` 不可变视图并调用同一 updater resume。流程不 pull、不 recreate 在线镜像；Caddy 只新增 public jobs 路由，validate/reload 失败恢复原文件。
- **S4_BOOTSTRAP_STACK**: 等云端 user-data 安装 Docker 并启动 `postgres:18 + message-server + caddy + coturn`，轮询 `https://<domain>/healthz`。
- **S5_INIT_TOKENS**: SSH 读取云端 `init-tokens.sh` 生成的 `/var/dirextalk-message-server/p2p/bootstrap.json`，归一化 `password`、`access_token`、`agent_token`、真实 `agent_room_id`。云端脚本会先调用 `portal.bootstrap`，用 `agent_token` 创建 `@agent:<server>` Matrix session，再用 owner Matrix token 创建房间并邀请/加入 agent，最后回写真正的 agent room。`password`、owner `access_token` 和 `agent_token` 按一次性/易失凭据处理；需要登录或用 token 调接口前，必须重新从服务器拉取最新 `/var/dirextalk-message-server/p2p/bootstrap.json`，不要复用旧输出。
- **S6_WIRE_LOCAL**: 写本地凭据、用 `agent_token` 创建 `@agent:<server>` Matrix session、写 `dirextalk-connect/config.toml`，写 MCP 配置片段，并按策略安装或
...[truncated 25 chars]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/state-machine.md (reported line 11)May include surrounding context.

md

- **S1_PREFLIGHT**: 校验 region、Lightsail 套餐和 Lightsail 可用区,然后选择云提供方;不查询 AWS Free Tier 或免费额度使用情况。默认 Lightsail,默认 AZ 是 `<region>a`;如果默认 AZ 不可用则选择同 region 其他可用 Lightsail AZ;如果 Lightsail 当前 region 没有可用套餐或可用区,且用户没有显式强制 Lightsail,则在 S1 记录选择 EC2。EC2 路径会校验默认 VPC、vCPU 配额、Elastic IP 可用配额和 Ubuntu 24.04 amd64 AMI。
- **S2_DOMAIN**: 确认正式长期域名和 Matrix `server_name` 不可逆绑定。
- **S3_PROVISION**: 按 S1 记录的 provider 创建资源。开始创建云资源前解析最新稳定 server GitHub Release、校验 manifest checksum,并在 `state.json.server_release` 固定 version/image/digest/image_ref/manifest_digest,同时记录独立 updater 的 version/commit/SHA-256 pin。Lightsail 路径创建 Ubuntu 24.04 实例、密钥对、静态 IP 和防火墙端口;EC2 创建 Ubuntu 24.04 amd64 实例、密钥对、安全组、Elastic IP 和 50 GiB gp3 root EBS。两条路径的 user-data 都包含 bootstrap;在校验宿主为 Ubuntu 22.04 或 24.04 x86_64 后,bootstrap 直接下载固定 updater Release URL、核对 deployer 固定 SHA-256 并原子安装。S3 只通过 SSH 触发可续跑 bootstrap,不复制二进制。`MESSAGE_SERVER_IMAGE` 只在同时设置 `DIREXTALK_ALLOW_MESSAGE_SERVER_IMAGE_OVERRIDE=1` 的 debug/legacy 部署中可用。
- **LEGACY_ADOPT**: 不属于普通 S3 resume。仅 `scripts/adopt-legacy-node.sh` 在 dry-run 证明固定 d1 v0.15.2/digest/Compose/host-Caddy 拓扑并收到精确确认后,写入 `server_release.source=legacy_adopted`,生成 `/var/dirextalk-message-server` 不可变视图并调用同一 updater resume。流程不 pull、不 recreate 在线镜像;Caddy 只新增 public jobs 路由,validate/reload 失败恢复原文件。
- **S4_BOOTSTRAP_STACK**: 等云端 user-data 安装 Docker 并启动 `postgres:18 + message-server + caddy + coturn`,轮询 `https://<domain>/healthz`。
- **S5_INIT_TOKENS**: SSH 读取云端 `init-tokens.sh` 生成的 `/var/dirextalk-message-server/p2p/bootstrap.json`,归一化 `password`、`access_token`、`agent_token`、真实 `agent_room_id`。云端脚本会先调用 `portal.bootstrap`,用 `agent_token` 创建 `@agent:<server>` Matrix session,再用 owner Matrix token 创建房间并邀请/加入 agent,最后回写真正的 agent room。`password`、owner `access_token` 和 `agent_token` 按一次性/易失凭据处理;需要登录或用 token 调接口前,必须重新从服务器拉取最新 `/var/dirextalk-message-server/p2p/bootstrap.json`,不要复用旧输出。
- **S6_WIRE_LOCAL**: 写本地凭据、用 `agent_token` 创建 `@agent:<server>` Matrix session、写 `dirextalk-connect/config.toml`,写 MCP 配置片段,并按策略安装或
...[truncated 25 chars]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly instructs the workflow to write local credentials and to handle bootstrap passwords and tokens, but it does not pair that with clear warnings about sensitivity, storage protections, or operator hygiene. In a deployment skill that provisions production infrastructure and persists auth material under predictable paths, this omission increases the chance of credential exposure through weak file permissions, backups, shell history, or accidental sharing.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/state-machine.md (reported line 47)May include surrounding context.

md

- DNS 未指向固定 public IP: S3 返回 waiting。Route53 模式下先检查 hosted zone/NS 委托；manual DNS fallback 下用户或 DNS provider automation 设置 A 记录后用 `DNS_READY=1` 续跑。
- `/healthz` 不通: 看 `/var/log/cloud-init-output.log` 和 `docker compose logs message-server`。
- bootstrap 缺字段: 在实例上重跑 `sudo sh -lc 'cd /var/dirextalk-message-server && DOMAIN=<domain> bash /var/dirextalk-message-server/init-tokens.sh'`，再看宿主 `/var/dirextalk-message-server/p2p/bootstrap.json` 和容器内 `/var/dirextalk-message-server/p2p/bootstrap.json`。
- `agent_room_id` 缺失或是旧伪 ID: 确认 `.env` 有 `P2P_PORTAL_PASSWORD`，然后重跑 `/var/dirextalk-message-server/init-tokens.sh`；脚本应创建真实 Matrix room 并回写。
- TURN 为空: 检查 `TURN_SECRET`、coturn、安全组 3478 和 49160-49200/udp。

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill document is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown file presents all operational instructions in Chinese, including critical deployment and recovery steps, with no indication that users may choose another language. That can violate a language/locale policy when a skill forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/agent-targets.md:87