T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:50- Finding
Installation of a Proxy-Controlled Root CA in the System Trust Store
- Content
View full analysis
- Remediation
View remediation
Security audit
fastgithub
Security checks for vulnerabilities and agentic risk
Overview
This GitHub acceleration proxy is disclosed, but it asks users to run an unverified missing binary and make broad TLS/proxy changes that can affect future traffic.
Review this carefully before installing. Only use it if you trust the FastGithub binary and certificate source, can verify their integrity, and are comfortable with a local proxy that may affect HTTPS behavior. Avoid installing the root CA or disabling Git TLS verification globally unless you fully understand and later undo those changes.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:127- Finding
Global Disabling of Git TLS Certificate Verification
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
install.sh:9- Finding
Execution of an Unverified and Absent External Binary Artifact
- Content
View full analysis
/dev/null; then echo "FastGithub 已在运行中" exit 0 fi echo "正在启动 FastGithub..." cd "$INSTALL_DIR/publish" nohup ./fastgithub > /workspace/fastgithub.log 2>&1 & ``` Related startup paths execute the same expected binary without validation: ```bash cd /workspace/skills/fastgithub/publish nohup ./fastgithub > /workspace/fastgithub.log 2>&1 & ``` ### Technical Analysis The scripts expect `fastgithub-linux-x64.tar.gz` and `publish/fastgithub`, but neither artifact exists in the audited project. Their contents and behavior therefore cannot be reviewed from the supplied files. Before execution, the scripts do not verify a cryptographic signature, pinned digest, trusted source, file ownership, or permissions. The installer consequently trusts whichever archive or executable is placed at the expected fixed path. The archive is also extracted directly without first validating its file list. A maliciously supplied archive could contain unexpected paths, symbolic links, or a substituted executable. Once extracted, `./fastgithub` runs with all privileges available to the user invoking the script and is positioned to control proxied GitHub traffic. ### Attack Path 1. An external source or local actor supplies `fastgithub-linux-x64.tar.gz`, or places a `publish/fastgithub` executable at the expected path. 2. The user invokes `install.sh`, `start.sh`, or `restart.sh`. 3. The script performs no signature, checksum, ownership, or provenance validation. 4. The attacker-controlled executable is launched with the invoking user's privileges. 5. The executable can ...[truncated 727 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
stop.sh:4- Finding
Overbroad Process Discovery and Termination Through Command-Line Substring Matching
- Content
View full analysis
/dev/null; then ``` The restart script uses the same broad termination mechanism: ```bash pkill -f fastgithub sleep 1 cd /workspace/skills/fastgithub/publish nohup ./fastgithub > /workspace/fastgithub.log 2>&1 & sleep 2 if pgrep -f "fastgithub" > /dev/null; then ``` ### Technical Analysis The `-f` option makes `pkill` and `pgrep` compare the supplied pattern against the entire process command line. Any process whose arguments or executable path contain the substring `fastgithub` may match, even if it is unrelated to the intended proxy process. This can cause `stop.sh` and `restart.sh` to terminate unrelated workloads. The same matching strategy can also cause installation or startup checks to report that FastGithub is already running when only an unrelated matching process exists. The scripts do not maintain a PID file or verify that a matched PID resolves to the expected executable under `/workspace/skills/fastgithub/publish`. ### Attack Path 1. A legitimate unrelated process runs with `fastgithub` somewhere in its command line, arguments, or path. 2. The user invokes `stop.sh` or `restart.sh`. 3. `pkill -f fastgithub` selects every process whose complete command line matches the substring. 4. The unrelated process receives a termination signal and may stop unexpectedly. 5. Alternatively, an attacker starts a harmless matching process before installation. 6. `pgrep -f "fastgithub"` returns success, causing the script to falsely conclude that the proxy is already running. ### Impact Assessment The direct impact is unauthorized termination of processes owned by the invoking account, potentially causing service disruption, loss of unsaved work, or inte ...[truncated 305 chars]- Remediation
View remediation
/exe` with the canonical path of `publish/fastgithub`. - Reject stale PID files rather than falling back to broad substring matching. - Use a service manager such as systemd where appropriate, with an explicit executable path and dedicated service identity. - Check the actual child PID after startup instead of using `pgrep -f`. - Quote all paths and restrict permissions on the installation and PID-file directories. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (17)
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
`bash
自动安装并启动
bash /workspace/skills/fastgithub/install.sh
text ### 手动安装步骤 #### 1. 解压安装包 ```bash tar -xzf fastgithub-linux-x64.tar.gz -C ~/fastgithub2. 启动服务
bash cd ~/fastgithub/publish ./fastgithub &3. 设置 Git 代理
bash export http_proxy=http://127.0.0.1:38457 export https_proxy=http://127.0.0.1:38457 # 永久生效 echo "export http_proxy=http://127.0.0.1:38457" >> ~/.bashrc echo "export https_proxy=http://127.0.0.1:38457" >> ~/.bashrc source ~/.bashrc4. 安装 CA 证书（可选，但推荐）
bash # Ubuntu/Debian sudo cp ~/fastgithub/publish/cacert/fastgithub.crt /usr/local/share/ca-certificates/ sudo update-ca-certificates # macOS sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/fastgithub/publish/cacert/fastgithub.crt # Windows (需要管理员权限) # 双击证书文件 -> 安装到"受信任的根证书颁发机构"
使用命令
|
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill recommends installing and trusting a new CA certificate as a root certificate without a strong warning about the implications. Trusting a new root CA enables the proxy to intercept TLS traffic and, if that certificate or service is malicious or compromised, can permit man-in-the-middle decryption of trusted HTTPS connections.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sudo update-ca-certificates # macOS sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/fastgithub/publish/cacert/fastgithub.crt # Windows (需要管理员权限) # 双击证书文件 -> 安装到"受信任的根证书颁发机构"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md sudo update-ca-certificates # macOS sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/fastgithub/publish/cacert/fastgithub.crt # Windows (需要管理员权限) # 双击证书文件 -> 安装到"受信任的根证书颁发机构"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation tells users to persistently set http_proxy and https_proxy in ~/.bashrc, which can route future command-line traffic through the local proxy beyond the immediate GitHub use case. This is dangerous because users may unknowingly affect other tools and sessions, increasing interception, misrouting, or breakage risk if the proxy is compromised or left running unintentionally.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The documentation instructs running sudo to copy a certificate into the system trust store. Requiring elevated privileges increases risk because it modifies a security-sensitive system location and can have broad effects if the certificate or installation path is not trustworthy.
- Content
4. 安装 CA 证书（可选，但推荐）
bash # Ubuntu/Debian sudo cp ~/fastgithub/publish/cacert/fastgithub.crt /usr/local/share/ca-certificates/ sudo update-ca-certificates # macOS
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
Using sudo update-ca-certificates applies trust-store changes system-wide, affecting all users and applications on the host. This is dangerous in context because it operationalizes trust for the added certificate and can broaden the blast radius of any mistake or compromise.
- Content
bash # Ubuntu/Debian sudo cp ~/fastgithub/publish/cacert/fastgithub.crt /usr/local/share/ca-certificates/ sudo update-ca-certificates # macOS sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/fastgithub/publish/cacert/fastgithub.crt
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The macOS command uses sudo to add the certificate as a trusted root in the System keychain, which is a privileged, security-sensitive change. In this context, that enables broad TLS trust for the proxy certificate and could facilitate interception of HTTPS traffic if abused.
- Content
md sudo update-ca-certificates # macOS sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/fastgithub/publish/cacert/fastgithub.crt # Windows (需要管理员权限) # 双击证书文件 -> 安装到"受信任的根证书颁发机构"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 3. **系统要求** — Linux (x64), macOS, Windows 4. **权限** — 需要 sudo 安装 CA 证书 ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The script launches a long-lived background process with nohup and leaves it running beyond the install session, which creates session persistence inside the workspace. In this skill context, that process is a local HTTP proxy and the script also encourages use of it via proxy environment variables, so an unreviewed or compromised binary could continue intercepting or influencing subsequent network traffic after installation.
- Content
sh # 启动服务 echo "正在启动 FastGithub..." cd "$INSTALL_DIR/publish" nohup ./fastgithub > /workspace/fastgithub.log 2>&1 & sleep 2 # 验证启动
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh sleep 1 cd /workspace/skills/fastgithub/publish nohup ./fastgithub > /workspace/fastgithub.log 2>&1 & sleep 2 if pgrep -f "fastgithub" > /dev/null; then
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh sleep 1 cd /workspace/skills/fastgithub/publish nohup ./fastgithub > /workspace/fastgithub.log 2>&1 & sleep 2 if pgrep -f "fastgithub" > /dev/null; then
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This shell script includes user-facing messages only in Chinese, such as the startup status lines and comments, with no indication that the skill is region-specific or that users can opt into a preferred language. That creates a natural-language policy issue because the skill effectively forces a specific language for interaction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script unconditionally runs
pkill -f fastgithub, which is a destructive action that terminates matching processes. While it reports success or failure afterward, there is no prior confirmation prompt, cautionary comment, or other user-facing warning before the irreversible stop action occurs.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation, trigger phrases, and usage guidance are all presented in Chinese, which may impose a language requirement on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's comments and all user-facing echo messages are in Chinese, which imposes a specific language on users with no opt-in or alternative locale. This matches the policy category for language or locale constraints appearing in natural-language content within code files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script includes natural-language comments and output messages only in Chinese, such as the stop status messages. This can violate language/locale policy expectations when no user opt-in or documented locale constraint is provided.
- Content
Static analysis
No suspicious patterns detected.