Google Jules Tools CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:49 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for managing Jules coding sessions, but it needs review because it recommends an unpinned global npm install with an optional sudo fallback.

Review this skill before installing. Prefer a pinned or user-scoped Jules CLI installation and avoid running npm install with sudo unless you have independently verified the package and accept the system-level risk. Before using pull, run it in a clean branch or disposable workspace and inspect the resulting diff before executing or merging the code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28
• Finding: Unpinned Global Package Installation with Optional Root Privileges## Vulnerability Details **File Location**: `SKILL.md`, lines 28–32 **Vulnerability Type**: Unpinned third-party package installation with privileged execution **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @google/jules ``` ```bash sudo npm install -g @google/jules ``` ### Technical Analysis The skill instructs the agent to install the latest available version of `@google/jules` globally without pinning a reviewed version or verifying package integrity and provenance. The effective code installed by this command can therefore change after the skill itself has been audited. The suggested fallback further runs npm through `sudo`. npm packages can execute lifecycle scripts during installation, so this may execute package-controlled code with root privileges. No evidence indicates that the named package is currently malicious; the risk arises from the unsafe dependency installation procedure and the impact of a potential upstream package or release compromise. ### Attack Path 1. An attacker compromises the package publisher account, package registry delivery path, or a future package release. 2. The attacker publishes a modified version containing a malicious npm lifecycle script or executable payload. 3. An agent follows the skill and runs the unpinned `npm install -g @google/jules` command. 4. npm retrieves the attacker-controlled latest release and executes applicable lifecycle scripts. 5. If the documented `sudo` fallback is used, the payload executes with root privileges and can modify system-wide files. ### Impact Assessment A normal global installation may modify globally installed Node.js packages and expose attacker-controlled commands to users of the environment. Depending on npm configuration and directory permissions, compromise may extend to the executing user's files, credentials, source repositories, and accessible network resources. If the `sudo` command is used, malicious installation code can obtain root-level execut ...[truncated 277 chars]
• Remediation: ## Remediation Suggestions - Pin `@google/jules` to an exact, reviewed version rather than installing the mutable latest release. - Verify package provenance, publisher identity, and registry metadata before installation. - Record and validate the expected package integrity hash where the installation workflow supports it. - Remove the recommendation to run `sudo npm install -g`; do not execute third-party package installation scripts as root. - Prefer a user-scoped npm prefix, a project-local installation, or an isolated container or virtual environment. - Consider disabling npm lifecycle scripts during installation when compatible, then explicitly review and run only required setup operations. - Establish a controlled update process that reviews new versions before changing the pinned dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

npm install -g @google/jules
```

> **Note:** Installation might require `sudo` permissions depending on the system configuration. If `npm install -g` fails due to permissions, try `sudo npm install -g @google/jules` or ask the user for assistance.

### 2. Authentication

• Confidence: 88% confidence
• Finding: The skill explicitly recommends `sudo npm install -g @google/jules` if a global install fails. Encouraging privileged installation of a network-fetched npm package increases the blast radius of supply-chain compromise or package/script abuse, since install-time scripts would execute with elevated privileges.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to run `jules remote pull --session <session_id>` to retrieve results but does not clearly warn that this operation can modify the local repository by applying AI-generated code changes. In an agent context, that omission is risky because users or downstream agents may treat the action as read-only and unintentionally introduce unreviewed code into the working tree.

Static analysis

No suspicious patterns detected.