ClawHub
Back to skill

Security audit

Deepin Desktop Control

Security checks for vulnerabilities and agentic risk

Overview

The skill is a broad Deepin/UOS desktop-control guide, but it includes direct privileged account, boot, and package-management actions without clear safeguards and ships local account metadata.

Install only if you intentionally want an agent to operate Deepin/UOS system settings. Before use, require explicit approval for account, bootloader, package, time, network, security, and other mutating commands. The publisher should redact the bundled local account metadata and replace the hardcoded output path with a caller-selected or package-relative path before broad distribution.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/06b_accounts1_user1000.txt:56
Finding

Host-Specific Account Metadata Exposed in Bundled D-Bus Snapshots

Content
View full analysis
Remediation
View remediation
}" mkdir -p -- "$OUTPUT_DIR" chmod 700 -- "$OUTPUT_DIR" ``` 5. Write generated snapshots outside the published Skill tree by default. 6. Add generated introspection output to version-control and packaging ignore rules. 7. Apply restrictive permissions to temporary and generated files, such as `umask 077`. 8. Introduce an automated pre-release scan that rejects usernames, home paths, UUIDs, credentials, tokens, account memberships, and live D-Bus property values. 9. Use synthetic example values in documentation, such as `example-user`, `/home/example-user`, and a clearly non-production UUID. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The exposed D-Bus interface includes sensitive account-management operations such as SetPassword, SetHomeDir, SetShell, SetGroups, AddGroup/DeleteGroup, EnableNoPasswdLogin, and AutomaticLogin controls. In the absence of any justified skill purpose or documented authorization boundary, surfacing these capabilities creates a powerful privilege-management surface that could be abused to alter authentication, elevate privileges, or weaken system account security.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section documents privileged account-management operations such as creating/deleting users and groups and toggling guest access, but provides no warning, confirmation guidance, or safety constraints. In an agent skill context, these examples can directly enable destructive or security-sensitive system changes if invoked automatically or copied blindly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes bootloader modification commands and package-management actions without emphasizing that these can affect bootability, software integrity, or system stability. In a desktop-control skill, presenting such commands as routine operations increases the chance an agent or user performs high-risk changes without understanding consequences.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

The documentation explicitly instructs use of sudo for package installation, introducing privilege escalation and system modification capability within the skill. Although common in administration docs, in an agent skill this is risky because it normalizes privileged execution without guardrails, verification, or user approval requirements.

Content

Scanner excerpt · SKILL.md (reported line 583)May include surrounding context.

apt-cache search

Install package

sudo apt install -y

text

---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language/config value sets Locale = 'zh_CN.UTF-8', which enforces a specific language/locale in this account definition. The file does not indicate that this locale is user-selected, optional, or justified by a region-specific purpose, so it conflicts with the policy against forcing a locale without opt-in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md
properties:
      readonly s GuestIcon = 'file:///var/lib/AccountsService/icons/illustration/computer.png';
      readonly b AllowGuest = false;
      readonly as GroupList = ['_ssh', 'adm', 'audio', 'avahi', 'backup', 'bin', 'bluetooth', 'cdrom', 'crontab', 'daemon', 'dde', 'deepin-admin-daemon', 'deepin-daemon', 'deepin-linglong', 'dialout', 'dip', 'disk', 'fax', 'floppy', 'games', 'geoclue', 'input', 'irc', 'kmem', 'kvm', 'lightdm', 'list', 'lp', 'lpadmin', 'mail', 'man', 'messagebus', 'netdev', 'news', 'nm-openconnect', 'nm-openvpn', 'nogroup', 'operator', 'pipewire', 'plugdev', 'polkitd', 'proxy', 'pulse', 'pulse-access', 'render', 'root', 'sambashare', 'sasl', 'scanner', 'seat', 'sgx', 'shadow', 'src', 'ssl-cert', 'sstpc', 'staff', 'sudo', 'sys', 'systemd-coredump', 'systemd-journal', 'systemd-network', 'systemd-timesync', 'tape', 'tss', 'tty', 'users', 'utmp', 'uucp', 'video', 'voice', 'winbindd_priv', 'www-data', 'zane'];
      readonly b IsTerminalLocked = false;
      readonly b QuickLoginEnabled = true;
      readonly as UserList = ['/org/deepin/dde/Accounts1/User1000'];

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md
properties:
      readonly s GuestIcon = 'file:///var/lib/AccountsService/icons/illustration/computer.png';
      readonly b AllowGuest = false;
      readonly as GroupList = ['_ssh', 'adm', 'audio', 'avahi', 'backup', 'bin', 'bluetooth', 'cdrom', 'crontab', 'daemon', 'dde', 'deepin-admin-daemon', 'deepin-daemon', 'deepin-linglong', 'dialout', 'dip', 'disk', 'fax', 'floppy', 'games', 'geoclue', 'input', 'irc', 'kmem', 'kvm', 'lightdm', 'list', 'lp', 'lpadmin', 'mail', 'man', 'messagebus', 'netdev', 'news', 'nm-openconnect', 'nm-openvpn', 'nogroup', 'operator', 'pipewire', 'plugdev', 'polkitd', 'proxy', 'pulse', 'pulse-access', 'render', 'root', 'sambashare', 'sasl', 'scanner', 'seat', 'sgx', 'shadow', 'src', 'ssl-cert', 'sstpc', 'staff', 'sudo', 'sys', 'systemd-coredump', 'systemd-journal', 'systemd-network', 'systemd-timesync', 'tape', 'tss', 'tty', 'users', 'utmp', 'uucp', 'video', 'voice', 'winbindd_priv', 'www-data', 'zane'];
      readonly b IsTerminalLocked = false;
      readonly b QuickLoginEnabled = true;
      readonly as UserList = ['/org/deepin/dde/Accounts1/User1000'];

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/06_accounts1.txt (reported line 47)May include surrounding context.

text
properties:
      readonly s GuestIcon = 'file:///var/lib/AccountsService/icons/illustration/computer.png';
      readonly b AllowGuest = false;
      readonly as GroupList = ['_ssh', 'adm', 'audio', 'avahi', 'backup', 'bin', 'bluetooth', 'cdrom', 'crontab', 'daemon', 'dde', 'deepin-admin-daemon', 'deepin-daemon', 'deepin-linglong', 'dialout', 'dip', 'disk', 'fax', 'floppy', 'games', 'geoclue', 'input', 'irc', 'kmem', 'kvm', 'lightdm', 'list', 'lp', 'lpadmin', 'mail', 'man', 'messagebus', 'netdev', 'news', 'nm-openconnect', 'nm-openvpn', 'nogroup', 'operator', 'pipewire', 'plugdev', 'polkitd', 'proxy', 'pulse', 'pulse-access', 'render', 'root', 'sambashare', 'sasl', 'scanner', 'seat', 'sgx', 'shadow', 'src', 'ssl-cert', 'sstpc', 'staff', 'sudo', 'sys', 'systemd-coredump', 'systemd-journal', 'systemd-network', 'systemd-timesync', 'tape', 'tss', 'tty', 'users', 'utmp', 'uucp', 'video', 'voice', 'winbindd_priv', 'www-data', 'zane'];
      readonly b IsTerminalLocked = false;
      readonly b QuickLoginEnabled = true;
      readonly as UserList = ['/org/deepin/dde/Accounts1/User1000'];

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/21_daemon_accounts.txt (reported line 47)May include surrounding context.

text
properties:
      readonly s GuestIcon = 'file:///var/lib/AccountsService/icons/illustration/computer.png';
      readonly b AllowGuest = false;
      readonly as GroupList = ['_ssh', 'adm', 'audio', 'avahi', 'backup', 'bin', 'bluetooth', 'cdrom', 'crontab', 'daemon', 'dde', 'deepin-admin-daemon', 'deepin-daemon', 'deepin-linglong', 'dialout', 'dip', 'disk', 'fax', 'floppy', 'games', 'geoclue', 'input', 'irc', 'kmem', 'kvm', 'lightdm', 'list', 'lp', 'lpadmin', 'mail', 'man', 'messagebus', 'netdev', 'news', 'nm-openconnect', 'nm-openvpn', 'nogroup', 'operator', 'pipewire', 'plugdev', 'polkitd', 'proxy', 'pulse', 'pulse-access', 'render', 'root', 'sambashare', 'sasl', 'scanner', 'seat', 'sgx', 'shadow', 'src', 'ssl-cert', 'sstpc', 'staff', 'sudo', 'sys', 'systemd-coredump', 'systemd-journal', 'systemd-network', 'systemd-timesync', 'tape', 'tss', 'tty', 'users', 'utmp', 'uucp', 'video', 'voice', 'winbindd_priv', 'www-data', 'zane'];
      readonly b IsTerminalLocked = false;
      readonly b QuickLoginEnabled = true;
      readonly as UserList = ['/org/deepin/dde/Accounts1/User1000'];

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The examples set the NTP server to "ntp.aliyun.com", the timezone to "Asia/Shanghai", and elsewhere use a Chinese boot entry title, which steers behavior toward a specific locale without stating that the skill is China-specific or allowing user opt-in. This is a natural-language locale policy concern because the documentation implies a default regional choice rather than a user-selected one.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This plain-text interface description enumerates callable methods but provides no indication of when they should or should not be invoked, nor any limiting context. For a non-code text file, that absence of trigger scope or exclusion conditions creates ambiguity about activation boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The exposed interface uses exclusively English natural-language identifiers such as method names and signal names, with no indication of locale choice or region-specific justification. Under the stated policy, language constraints should either be optional for the user or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file contains a user-facing error message entirely in Chinese, with no indication that language selection is optional or contextually required. This can violate language/locale policy when a skill presents output in a fixed language without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file content is entirely in Chinese and provides no indication that the user can choose another language or that the locale is required for a region-specific purpose. Under the policy for natural-language issues, forcing a specific language without opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The only user-facing text in this file is written in Chinese ('错误：...'), which imposes a specific language on the user. Under the stated policy, locale or language constraints should not be forced unless the skill offers a choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file contains only a Chinese-language error message and provides no indication that language selection is user-configurable or intentionally limited to a region-specific context. Under the policy, hardcoding a locale without opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file contains a user-visible error message entirely in Chinese ("错误：...") with no indication that language choice is optional or contextually required. Under the language/locale policy, hard-coding a specific language without documented opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.