3x-ui-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This prompt requires collecting and outputting sensitive secrets verbatim (provider root password/sudo password, generated panel username/password, x25519 private key/public key, client UUID/short-id and the full VLESS link) and instructs the agent to embed those secrets directly into commands, API requests, and guide files (e.g., sshpass, curl JSON, saved guide), which is direct secret handling/exfiltration risk.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list contains otherwise benign local and vendor links but also several direct-download/install endpoints (raw GitHub install.sh, GitHub release binaries for RealiTLScanner and Hiddify, and curl|sh-style installers like get.acme.sh) from personal/third‑party repos which are common malware distribution vectors and should be treated as suspicious until verified (checksums/signatures, repo reputation, and review of the script/binary contents).

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The guide intentionally instructs active evasion techniques (scanning a provider subnet to pick a neighbor SNI for TLS "Reality" masquerading), and directs downloading and executing remote binaries/scripts—behaviors that enable covert circumvention and present clear supply‑chain/remote‑code‑execution risk.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The runtime workflow fetches and executes outsider-authored free text/code from public web content: it downloads install.sh from https://raw.githubusercontent.com/mhsanaei/3x-ui/... and runs it (curl ... -o ... && sudo bash ...), and also downloads/runs RealiTLScanner from GitHub releases (curl ... -o /tmp/scanner && chmod +x /tmp/scanner && ...).

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly downloads and executes remote code at runtime — e.g., it runs the 3x-ui installer via curl https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh (saved and then executed with bash) and it downloads+executes the RealiTLScanner binary from https://github.com/XTLS/RealiTLScanner/releases/latest/download/RealiTLScanner-linux-${SA} — both are runtime-fetched artifacts that the setup relies on to install and configure the VPN panel/scanner.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs creating a non-root user, obtaining and using sudo/root, editing system files (ssh, sysctl, ufw), installing services and packages, and disabling/enabling security controls — all elevated, state-changing operations on the host.