download_mirror1

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:15 AM UTC
• Version: 1.0.0

Overview

This skill is aimed at fixing slow model and code downloads, but it can route downloads through third-party mirrors and modify the Python environment without enough user control or integrity guidance.

Install only if you are comfortable with an agent redirecting model, dataset, and repository downloads through mirror services. Do not use HuggingFace tokens with untrusted mirrors, do not disable certificate checks, and verify downloaded code or archives with commits, signatures, or hashes before building, importing, or running them. Prefer a pinned, preinstalled dependency environment rather than allowing the helper to install packages automatically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:167

Finding

Unverified repository and archive downloads through a third-party GitHub proxy

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:167-180; related implementation in scripts/diagnose.py:179-185 and scripts/mirror_download.py:214-215
Vulnerability Type: Third-party supply-chain and artifact-integrity risk
Risk Level: High

Vulnerable Code

bash

# 使用 ghfast.top 代理（速度快）
git clone https://ghfast.top/https://github.com/owner/repo.git

# 下载 Release 文件
wget "https://ghfast.top/https://github.com/owner/repo/releases/download/v1.0/file.zip"

bash

# 直接下载 tarball（避免 .git 历史，更快）
wget "https://ghfast.top/https://github.com/owner/repo/archive/refs/heads/main.tar.gz" \
     -O repo.tar.gz
tar xzf repo.tar.gz

The executable implementation also automatically adds the proxy as a clone candidate:

python

if check_host("ghfast.top"):
    candidates.append(f"https://ghfast.top/https://github.com/{repo_path}.git")

Technical Analysis

The Skill treats ghfast.top as a trusted intermediary whenever a basic connectivity check succeeds. A successful HTTPS connection only authenticates the proxy endpoint; it does not prove that the returned repository or artifact is identical to content published by GitHub.

No publisher signature, SHA-256 digest, immutable Git commit identifier, release attestation, or repository identity check is performed. The documentation also immediately extracts downloaded archives. This creates a supply-chain boundary in which the effective downloaded content can be changed by the proxy or by an attacker who compromises it.

The Skill does not automatically execute the downloaded repository or archive, so direct remote code execution is not established solely by this behavior. Exploitation requires a later workflow to install, import, build, or execute the substituted content.

Attack Path

1. A user asks the Skill to retrieve a GitHub repository, release, or source archive.
2. GitHub is unavailable or the third-party proxy is selected ...[truncated 985 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the third-party proxy from the automatic fallback list, or require explicit informed user approval before routing downloads through it.
2. Prefer downloads directly from the original publisher endpoint.
3. Pin repositories to immutable commit hashes rather than mutable branches such as main.
4. Require publisher-provided SHA-256 or stronger digests for release files and archives.
5. Verify signed Git commits, signed tags, release signatures, or supply-chain attestations where available.
6. Perform verification before extracting, importing, building, or executing downloaded content.
7. Extract archives into a dedicated destination after validating archive paths and content.
8. Do not treat endpoint reachability as evidence of artifact provenance or integrity.

T08 · Insecure Dependencies

Warning

• Location: scripts/mirror_download.py:267

Finding

Automatic installation of unpinned Python dependencies into the active environment

Content

View full analysis

Vulnerability Details

File Location: scripts/mirror_download.py:267-276; invoked at scripts/mirror_download.py:110 and scripts/mirror_download.py:166
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

python

def _ensure_package(package: str) -> None:
    """确保 Python 包已安装"""
    try:
        __import__(package.replace("-", "_"))
    except ImportError:
        print(f"[mirror-download] 正在安装 {package}...")
        subprocess.run(
            [sys.executable, "-m", "pip", "install", package, "-q"],
            check=True
        )

The function is called with fixed package names:

python

_ensure_package("huggingface_hub")

python

_ensure_package("modelscope")

Technical Analysis

Normal execution of the download helper can silently invoke pip and mutate the active Python environment. Neither package is pinned to an audited version, and no lock file, expected package hash, trusted package index, or isolated virtual environment is enforced.

Python package installation can run build backends and other package-controlled installation logic. The installed packages are then imported and used in the same workflow. Consequently, compromise of the configured package index, a dependency, or a newly published package version can introduce executable code.

The package arguments are fixed constants rather than direct user input, and subprocess.run receives an argument list without shell=True. Therefore, this finding is not command injection or package-name injection.

Attack Path

1. The user runs a model download on a system where huggingface_hub or modelscope is absent.
2. _ensure_package catches the import failure and invokes pip install automatically.
3. Pip resolves the latest matching package and transitive dependencies from the environment's configured package index.
4. A compromised package, ...[truncated 798 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic package installation from normal download execution.
2. Declare dependencies as an explicit installation prerequisite.
3. Pin direct and transitive dependencies to reviewed versions in a lock file.
4. Use hash-verified installation, such as pip requirements containing --hash entries and installation with --require-hashes.
5. Restrict installation to an approved package index and verify its TLS configuration.
6. Install dependencies inside a dedicated virtual environment or container rather than mutating the active interpreter.
7. Require explicit user confirmation before any environment modification.
8. Run dependency scanning and periodically update pinned versions through a controlled review process.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:252

Finding

Documentation recommends disabling TLS certificate verification for downloads

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:252
Vulnerability Type: TLS server-authentication bypass
Risk Level: Medium

Vulnerable Code

text

| `SSL: CERTIFICATE_VERIFY_FAILED` | SSL 问题 | 加 `--no-check-certificate` 或更新证书 |

Technical Analysis

The troubleshooting guidance presents --no-check-certificate as an alternative response to certificate validation failure. This option disables TLS certificate and hostname verification, preventing the client from authenticating the remote server.

This is particularly dangerous for a Skill whose primary purpose is downloading repositories, model artifacts, and release files. Encryption without server authentication does not prevent a man-in-the-middle attacker from presenting a substitute certificate and modifying the downloaded content.

The guidance does not require separate signature or checksum verification when certificate checking is disabled.

Attack Path

1. A user encounters a TLS certificate validation error while downloading an artifact.
2. The user follows the Skill's troubleshooting guidance and adds --no-check-certificate.
3. A malicious network gateway, proxy, DNS redirection point, or local network attacker intercepts the request.
4. Because server authentication is disabled, the client accepts the attacker's certificate.
5. The attacker supplies a modified model file, archive, source repository, or release artifact.
6. The substituted content is stored locally and may later be imported, installed, built, or executed.

Impact Assessment

The immediate impact is loss of download confidentiality, authenticity, and integrity. An attacker can observe requests and substitute arbitrary downloaded content.

If modified content is later executed or imported, the attacker may obtain arbitrary code execution with the privileges of the affected downstream process. The bypass itself does not grant elevated privileges, and exploita ...[truncated 74 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --no-check-certificate from the recommended troubleshooting options.
2. Correct the underlying certificate problem by updating the operating-system trust store, correcting the system clock, verifying the hostname, or configuring the legitimate proxy certificate authority.
3. Never disable certificate validation for source code, executable files, model artifacts, or package downloads.
4. If an exceptional insecure transfer is unavoidable, require explicit informed approval and independently verify a publisher-provided cryptographic signature or digest before using the content.
5. Fail closed when certificate validation cannot be completed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description promises an operational skill that should activate on failed/slow HuggingFace or GitHub downloads and automatically switch to domestic mirrors to complete the task. The supplied code instead acts as a standalone diagnosis script: it tests reachability of several domains and prints candidate commands for the user to run. While the domain focus (HuggingFace/GitHub mirrors) is related, the primary purpose is materially different. The declared behavior emphasizes immediate automatic mirror switching after failure, whereas the code neither hooks into download failures nor executes the mirror download itself. This is more than an implementation detail; it changes the core capability from automatic remediation to manual advisory diagnostics.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Recommending --no-check-certificate disables TLS certificate validation, allowing man-in-the-middle interception and tampering with downloaded models, datasets, or code. In this skill's context, that is especially dangerous because the downloaded artifacts may later be executed or loaded, turning a network interception into a supply-chain compromise.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The explicit suggestion to use the --no-check-certificate parameter is a concrete unsafe tool invocation that suppresses a core transport-security control. An attacker on the network path could exploit this to substitute malicious files while the user believes they are downloading legitimate repositories or model weights.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

| `ConnectionError: HTTPSConnectionPool` | 原站不可达 | 切换 hf-mirror |
| `requests.exceptions.Timeout` | 超时 | 切换镜像，增加 `--timeout 120` |
| `OSError: We couldn't connect to...` | huggingface_hub 连不上 | 设置 `HF_ENDPOINT` |
| `SSL: CERTIFICATE_VERIFY_FAILED` | SSL 问题 | 加 `--no-check-certificate` 或更新证书 |
| `Repository not found` | 模型ID有误 | 查 ModelScope 搜索对应ID |
| `GatedRepo` / 需要登录 | 模型需授权 | 用 `--token <hf_token>` 或换用 ModelScope |
| `git: unable to connect` | GitHub 不可达 | 切换 GitCode 或 ghfast.top |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell commands and uses environment variables to influence networked downloads, but it declares no explicit tool scope or permissions boundary. That makes the capability surface implicit, increasing the chance an agent can execute network probes or download-related commands without clear review or least-privilege constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation conditions are so broad that the skill may trigger for many generic download scenarios, causing an agent to route traffic through third-party mirrors or run diagnostics unexpectedly. In context, that raises the risk of unnecessary external network access, unintended code paths, and use of less-trusted sources without explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions suggest using access tokens with alternate endpoints and mirror workflows without warning that credentials should never be sent to untrusted services. If users reuse HuggingFace tokens against a mirror or proxied endpoint, tokens could be exposed, logged, or abused for account access and gated-model retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill recommends using third-party mirrors and proxy services like GitCode and ghfast.top without warning that these services can observe requests, alter downloaded content, or serve stale or malicious artifacts. Because the skill is specifically about downloading code and models, redirecting users to alternate sources materially increases supply-chain and privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing guidance are written exclusively in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly flags language or locale constraints when the skill does not offer user choice or document a justified regional limitation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 31)May include surrounding context.

python

"""检测 host 是否可达，返回 (是否可达, 耗时秒)"""
    try:
        start = time.time()
        r = subprocess.run(
            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
             "--connect-timeout", "3", "--max-time", str(timeout),
             f"https://{host}"],

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mirror_download.py (reported line 38)May include surrounding context.

python

"""检测 host 是否可达，返回 (是否可达, 耗时秒)"""
    try:
        start = time.time()
        r = subprocess.run(
            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
             "--connect-timeout", "3", "--max-time", str(timeout),
             f"https://{host}"],

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code file contains natural-language instructions and usage text exclusively in Chinese, including the module docstring and command help. Under the policy, forcing a specific language without opt-in or a documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

The script performs git clone on user-influenced repository URLs and branch names, which enables retrieval of arbitrary untrusted code from third-party mirrors. Although shell injection is mitigated by argument-list invocation, the skill context makes this dangerous because it automates acquisition of untrusted repositories from alternate sources without integrity verification, increasing supply-chain risk.

Content

Scanner excerpt · scripts/mirror_download.py (reported line 227)May include surrounding context.

python

cmd += ["--depth", "1"]
        cmd += ["-b", branch, clone_url, local_dir]
        
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode == 0:
            print(f"[mirror-download] ✓ Clone 完成: {local_dir}")
            return local_dir

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This finding correctly identifies that the skill silently installs Python packages, giving it software-installation capability beyond its stated mirror-download purpose. That broadens the attack surface and creates a supply-chain avenue where dependency resolution and package installation can introduce malicious code into the environment.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/mirror_download.py (reported line 270)May include surrounding context.

python

def _ensure_package(package: str) -> None:
    """确保 Python 包已安装"""
    try:
        __import__(package.replace("-", "_"))
    except ImportError:
        print(f"[mirror-download] 正在安装 {package}...")
        subprocess.run(

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

Automatically invoking pip install at runtime expands the skill from downloading content to modifying the execution environment and pulling executable code from package indexes. In this skill's context, that is a significant supply-chain risk because package installation may execute build hooks or install compromised dependencies without explicit user approval or version pinning.

Content

Scanner excerpt · scripts/mirror_download.py (reported line 273)May include surrounding context.

python

__import__(package.replace("-", "_"))
    except ImportError:
        print(f"[mirror-download] 正在安装 {package}...")
        subprocess.run(
            [sys.executable, "-m", "pip", "install", package, "-q"],
            check=True
        )

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file is entirely written in Chinese, including headings and usage instructions, but it does not indicate that the language choice is optional or that the reference is intended only for a Chinese-speaking or region-specific audience. Under the language/locale policy, a skill artifact that imposes a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The --no-safetensors-only flag name and help text suggest a safetensors-only default, but the implemented ignore list only excludes *.bin, *.pt, and pytorch_model*. As written, .safetensors and other files are still downloaded, so the inline documentation misstates the actual filtering behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.