VLAN Linux Client

管理 VLAN.CN Linux 客户端的安装、登录、组网连接、服务控制及网络诊断操作。

This skill appears to do what it claims (manage the VLAN.CN Linux client) but its install instruction is the main red flag: it asks you to run `curl … http://dl.vlan.cn/.../install.sh | sh` which downloads and executes code from an unverified HTTP endpoint. Before installing: 1) Do not run the pipe-to-sh command directly on production systems. 2) Prefer packages distributed over HTTPS with a checksum or GPG signature; verify the vendor's official website (https://www.vlan.cn) for verified install instructions and signatures. 3) Inspect the install script contents locally (download and read it) and run it in a disposable sandbox/container or VM first. 4) Avoid running installers as root unless you trust them; consider running with least privilege. 5) Use the recommended short-lived login codes instead of passwords to avoid credential leakage in shell history. 6) If you cannot verify the origin and integrity of dl.vlan.cn artifacts, treat installation as high-risk and consult your organization's security policy or the vendor for signed releases.

Type: OpenClaw Skill Name: vlan-linux-client Version: 1.0.0 The skill bundle provides instructions for managing the VLAN.CN Linux client but promotes a highly insecure installation method in SKILL.md and README.md. Specifically, it recommends executing a shell script downloaded via unencrypted HTTP with certificate verification explicitly disabled (curl -kfsSL http://dl.vlan.cn/vlan2.0/linux/install.sh | sh), which exposes users to Man-in-the-Middle (MitM) attacks. While the tool appears to be a legitimate networking service, these instructions represent a significant security vulnerability rather than intentional malice.