BYR CLI Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:35 PM UTC
• Version: 0.1.2

Overview

The skill is a coherent BYR CLI wrapper, but it asks users to install and trust an unpinned external CLI that handles browser/session credentials.

Review this skill before installing. Use it only if you trust the byr-pt-cli package source, avoid pasting real cookies or tokens into visible command lines or logs, and be cautious with browser-profile import because it gives the external CLI access to sensitive session material. Choose explicit download paths and run dry-runs first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13
• Finding: Unpinned Third-Party CLI Dependency Executes Outside the Audited Skill Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-27 **Vulnerability Type**: Unpinned and externally maintained executable dependency **Risk Level**: High ### Complete Code Snippet ```yaml "install": [ { "id": "brew", "kind": "brew", "formula": "byr-pt-cli", "tap": "1MoreBuild/tap", "bins": ["byr"], "label": "Install byr CLI (Homebrew)", }, { "id": "node", "kind": "node", "package": "byr-pt-cli", "bins": ["byr"], "label": "Install byr CLI (npm fallback)", }, ], ``` ### Technical Analysis The Skill delegates all authentication, browser-cookie extraction, network access, user-information retrieval, and file-download behavior to the external `byr` executable. The installation metadata permits that executable to be obtained from either a third-party Homebrew tap or npm without specifying an audited version, checksum, package integrity value, or immutable source revision. Consequently, the executable installed at deployment time can differ from the component that existed when the Skill was reviewed. The npm fallback and custom Homebrew tap expand the supply-chain attack surface. Because the binary handles authentication cookies and can access browser credential storage, compromise of either distribution channel would expose substantially more than ordinary search functionality. The project itself contains no embedded executable code demonstrating malicious behavior. The risk arises from placing complete trust in a mutable, externally distributed dependency. ### Attack Path 1. An attacker compromises the npm package, Homebrew tap, package maintainer account, or upstream release process. 2. The attacker publishes a modified release under the expected `byr-pt-cli` package or formula name. 3. A new Skill installation resolves and installs that release because no version or integrity value is pinned. 4. The Agent invokes the apparently legitimate `byr` bi ...[truncated 1053 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm package and Homebrew formula to a specifically reviewed, immutable version. 2. Require integrity verification using a cryptographic checksum, npm lockfile integrity value, signed release, or equivalent mechanism. 3. Prefer an official, verified distribution source over a custom tap where possible. 4. Document the dependency's source repository, publisher identity, expected signing keys, and release-verification procedure. 5. Review the executable source corresponding to the pinned artifact, especially browser-cookie access, credential storage, telemetry, network destinations, update behavior, and subprocess execution. 6. Run the CLI with least privilege in a sandbox that limits filesystem, browser-profile, process, and network access. 7. Allow network connections only to documented BYR service domains and deny unexpected outbound destinations. 8. Avoid automatic fallback to a second mutable package source unless that source is independently pinned and verified. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: examples.md:55
• Finding: Reusable Authentication Secrets Are Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `examples.md`, lines 55-57; also documented in `SKILL.md`, lines 63-65 **Vulnerability Type**: Sensitive authentication data exposed through process arguments and operational logs **Risk Level**: Medium ### Complete Code Snippet ```bash byr auth status --verify --json byr auth import-cookie --cookie "uid=...; pass=..." --json byr auth import-cookie --cookie "session_id=...; auth_token=...; refresh_token=..." --json ``` The corresponding command definitions in `SKILL.md` are: ```markdown - `byr auth status [--verify] --json` - `byr auth import-cookie --cookie "<cookie-header>" --json` - `byr auth import-cookie --from-browser <chrome|safari> [--profile <name>] --json` ``` ### Technical Analysis The documented authentication flow instructs users or Agents to place reusable cookie values directly in the `--cookie` command-line argument. Command-line secrets can be exposed through shell history, Agent command transcripts, debug logs, telemetry, process-list inspection, crash reports, terminal recording, or error-handling output. The affected formats include `uid` and `pass`, as well as `session_id`, `auth_token`, and an optional `refresh_token`. These values are authentication material rather than low-sensitivity configuration. A refresh token may remain useful after a short-lived access token or session expires. Live verification and authenticated operations necessarily involve communicating authentication state to the intended BYR service. That network use is consistent with the declared functionality. However, the reviewed documentation does not identify expected network destinations, transport guarantees, credential retention behavior, or redaction requirements. Because processing is delegated to the external `byr` binary, the project files alone cannot verify where the binary sends or stores those credentials. ### Attack Path 1. A user replaces the example placeholders with real BYR cookie or token ...[truncated 1479 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the `--cookie` argument with secret input through protected standard input, an operating-system credential store, or a permission-restricted file descriptor. 2. If file-based import is unavoidable, require restrictive permissions, validate ownership, avoid predictable temporary paths, and securely remove temporary material after import. 3. Disable shell-history recording around secret import and ensure Agent transcripts never include raw credentials. 4. Redact cookie values, access tokens, refresh tokens, and authorization headers from JSON output, errors, diagnostics, telemetry, and crash reports. 5. Ensure secret values are never included in process arguments or environment variables that may be visible to other processes. 6. Require explicit user consent before browser-cookie extraction. 7. Restrict browser access to the selected profile and the minimum BYR-specific cookie records rather than granting broad access to browser storage. 8. Document the exact network domains contacted, require TLS certificate validation, and reject redirects that could forward authorization material to another origin. 9. Store imported credentials using platform-protected secret storage and document retention, expiration, logout, and revocation behavior. 10. Add a security warning to the examples explaining that users must not paste real credentials into commands that may be logged. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The authentication examples normalize passing raw cookies and importing browser session data directly on the command line, which can expose secrets through shell history, process listings, logs, screenshots, and copied documentation. In a tool handling authenticated tracker access, these credentials may enable account takeover or unauthorized session reuse if mishandled.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file documents a command that writes output to ./1001.torrent, which affects user data on disk. The example is presented without any accompanying warning or note that it will create or overwrite a local file, so users may not realize it changes the filesystem.

Static analysis

No suspicious patterns detected.