ClawHub
Back to skill

Security audit

MiniCPM-o 4.5 Deploy

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a MiniCPM-o deployment guide, but it directs users or agents to run privileged and mutable remote install code without strong integrity controls.

Install only if you are comfortable with deployment tooling that changes the host environment and runs upstream installer code. Prefer a disposable VM, container, or dedicated virtual environment; review and pin the Git commit, installer checksum, and Python package versions before running the commands; and require explicit approval before any sudo or install step.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/download_model.py:34
Finding

Automatic Installation and Upgrade of Unpinned Python Packages

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:99
Finding

Execution of Remotely Retrieved Installers and Repository Scripts Without Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose centers on deployment and operation of MiniCPM-o 4.5 services, but the supplied code is a model acquisition utility. Its primary functions are probing Hugging Face vs. ModelScope, downloading the model snapshot, and validating config metadata. There is no code to launch a web demo, run vLLM, configure llamacpp-omni, expose inference endpoints, or troubleshoot runtime services. The package auto-install behavior is secondary but also absent from the description. This is a material description-behavior mismatch because the primary purpose differs.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

1.2 FFmpeg

bash
sudo apt update && sudo apt install -y ffmpeg

1.3 Clone Repository and Install Dependencies

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
84% confidence
Finding

Using curl with -k disables TLS certificate verification, training the agent or user to bypass transport security checks. Even though the target is localhost with a self-signed certificate, normalizing insecure flags can enable man-in-the-middle acceptance patterns and reduce trust guarantees if reused in other contexts.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

Verify with curl:

bash
curl -k https://localhost:8006/health

Four interaction modes:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill includes shell and file-read capabilities through explicit command sequences, but it does not declare any tool scope or allowed-tools boundaries. That creates an authorization gap: an agent may execute package installs, downloads, repository cloning, and process control without an explicit least-privilege contract, increasing the chance of unintended or overbroad system modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger description is broad enough to activate on many generic 'deploy/start/configure/troubleshoot' requests, which can cause the skill to be invoked outside its narrow intended context. In an agent framework, overbroad matching increases the risk of unnecessary shell guidance, downloads, package installation, or repo-cloning instructions being surfaced in unrelated situations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The agent guideline says only NVIDIA GPUs with at least 12GB VRAM are currently supported and instructs the agent not to provide deployment steps for Apple Silicon or CPU-only devices. Later, the hardware requirements table lists GGUF/llama.cpp as recommended for Apple M3+ and CPU-only environments, creating an active contradiction in the document about what platforms are supported.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill instructs the agent to run a sudo package installation command, which performs privileged system-wide changes. In an automated or semi-automated agent setting, privilege escalation without explicit scoping or confirmation can modify the host unexpectedly and increases the blast radius if the instruction is misapplied or combined with compromised package sources.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

1.2 FFmpeg

bash
sudo apt update && sudo apt install -y ffmpeg

1.3 Clone Repository and Install Dependencies

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Runtime package installation is broader than the script's stated purpose of downloading and verifying a model, and it implicitly modifies the host Python environment. Because deployment tooling often runs with elevated privileges in servers or containers, this behavior increases supply-chain risk and can lead to environment takeover or unstable, non-reproducible deployments.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/download_model.py (reported line 39)May include surrounding context.

python
def _ensure_package(package: str, pip_name: Optional[str] = None):
    """Import a package, installing it via pip if missing."""
    try:
        __import__(package)
    except ImportError:
        install_name = pip_name or package
        print(f"[*] Installing {install_name}...")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script automatically runs pip install -U at runtime, causing execution of unpinned third-party package installation code in the user's environment. In a deployment skill, this is especially dangerous because it expands trust to remote package indexes and can introduce supply-chain compromise, unexpected upgrades, or arbitrary code execution during install hooks.

Content

Scanner excerpt · scripts/download_model.py (reported line 43)May include surrounding context.

python
except ImportError:
        install_name = pip_name or package
        print(f"[*] Installing {install_name}...")
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "-U", install_name],
            stdout=subprocess.DEVNULL,
        )

Static analysis

No suspicious patterns detected.