puter-deployer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.0

Overview

This Puter deployment skill is mostly coherent, but its helper scripts accept unvalidated command inputs that could make local tools access or alter unintended resources.

Review this skill before installing. Use it only with trusted project paths, ordinary build-directory names, and verified HTTPS deployment URLs you control. Be especially careful with the API fallback because it can upload build artifacts using the active Puter account. The scripts should be hardened with URL validation, curl --, and build-directory canonicalization before routine use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/verify_url.sh:4
• Finding: Curl Option Injection Through an Unvalidated Verification URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/verify_url.sh`, lines 4–8 **Vulnerability Type**: Command option injection **Risk Level**: High ### Vulnerable Code ```bash URL="${1:?usage: verify_url.sh <url> [expected_snippet]}" SNIPPET="${2:-}" TMP="$(mktemp)" CODE=$(curl -sSL -o "$TMP" -w "%{http_code}" "$URL" || true) ``` ### Technical Analysis The script passes the user-controlled `URL` argument directly to `curl` without first validating it and without using the `--` end-of-options delimiter. Shell quoting prevents word splitting and shell metacharacter interpretation, but it does not prevent the invoked program from interpreting an argument beginning with `-` as a command-line option. Consequently, a value such as `--config=/path/to/file` or an equivalent short option can be interpreted as a curl option rather than as a URL. If an attacker can place or reference a crafted curl configuration file, that configuration can specify additional URLs, uploads, proxy settings, request headers, output destinations, or local file URLs. The script also lacks restrictions on URL schemes and destinations. This makes the option-injection weakness more consequential and permits requests to unintended internal or local resources if malicious curl behavior is introduced. ### Attack Path 1. An attacker influences the URL supplied to `verify_url.sh`. 2. The attacker supplies an option-shaped value, such as a curl configuration directive referencing a crafted or attacker-controlled local configuration file. 3. The script passes the value to `curl` without an option terminator. 4. Curl interprets the value as an option instead of a deployment URL. 5. Directives from the referenced configuration can cause unintended network requests, local-file access, file uploads, or writes to attacker-selected paths. 6. These operations execute with the filesystem and network privileges of the user or Agent running the Skill. ### Impact Assessment Successful explo ...[truncated 541 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Place the `--` option terminator before the URL: ```bash CODE=$(curl -sSL -o "$TMP" -w "%{http_code}" -- "$URL" || true) ``` 2. Validate that the input is an absolute `https://` URL before invoking curl. Reject values beginning with `-`, unsupported schemes, embedded credentials, malformed hosts, and control characters. 3. Where deployment targets are known, enforce an allowlist of approved Puter domains or expected target hosts. 4. Reduce denial-of-service and network abuse risk by setting connection, execution, redirect, and response-size limits. For example: ```bash curl \ --silent --show-error --location \ --connect-timeout 10 \ --max-time 30 \ --max-redirs 5 \ --max-filesize 10485760 \ --output "$TMP" \ --write-out "%{http_code}" \ -- "$URL" ``` 5. Consider rejecting redirects to local, loopback, link-local, private, or otherwise restricted addresses when URLs can originate from untrusted users. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/preflight.sh:4
• Finding: Find Expression Injection Through an Option-Shaped Build Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/preflight.sh`, lines 4–19 **Vulnerability Type**: Command option and expression injection **Risk Level**: Medium ### Vulnerable Code ```bash PROJECT_DIR="${1:-.}" BUILD_DIR="${2:-dist}" cd "$PROJECT_DIR" echo "[1/5] checking puter CLI" command -v puter >/dev/null || { echo "FAIL: puter CLI not found"; exit 2; } echo "[2/5] checking puter auth" if ! puter whoami >/dev/null 2>&1; then echo "FAIL: puter not authenticated. Run: puter login" exit 3 fi echo "[3/5] checking build dir" [ -d "$BUILD_DIR" ] || { echo "FAIL: build dir missing: $BUILD_DIR"; exit 4; } echo "[4/5] checking build dir non-empty" find "$BUILD_DIR" -mindepth 1 -print -quit | grep -q . ``` ### Technical Analysis Although `"$BUILD_DIR"` is correctly quoted against shell word splitting, `find` performs its own argument parsing. A build-directory name beginning with `-` can therefore be interpreted as a `find` expression, option, or action instead of a filesystem path. The preceding `[ -d "$BUILD_DIR" ]` check does not eliminate this issue because Unix files and directories may legally have names beginning with a hyphen. If an option-shaped directory exists, it can pass the directory test and then be interpreted differently by `find`. A particularly dangerous GNU `find` action is `-delete`. If an attacker creates a directory with that name and supplies `-delete` as the build-directory argument, `find` can treat it as an action rather than the intended starting path. Depending on the implementation and resulting expression, processing may begin from the current directory and perform destructive operations. The script runs after changing into the supplied project directory, so affected files can include project source and build artifacts. ### Attack Path 1. An attacker creates or causes the project to contain a directory with an option-shaped name, such as `-delete`. 2. The attacker causes the preflight script to be invok ...[truncated 951 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the build directory to an explicit absolute path before passing it to `find`: ```bash BUILD_DIR="$(realpath -- "$BUILD_DIR")" [ -d "$BUILD_DIR" ] || { echo "FAIL: build dir missing: $BUILD_DIR" exit 4 } find "$BUILD_DIR" -mindepth 1 -print -quit | grep -q . ``` 2. If `realpath` portability is a concern, reject option-shaped inputs and prefix relative paths with `./`: ```bash case "$BUILD_DIR" in -*) echo "FAIL: invalid build directory: $BUILD_DIR"; exit 4 ;; esac ``` 3. Canonicalize both the project directory and build directory, then verify that the build directory remains inside the intended project root. This prevents unexpected traversal to unrelated filesystem locations. 4. Prefer a path-presence check that does not expose an unnormalized user value to expression parsing. For example, after canonicalization: ```bash if [ -z "$(find "$BUILD_DIR" -mindepth 1 -maxdepth 1 -print -quit)" ]; then echo "FAIL: build dir empty: $BUILD_DIR" exit 5 fi ``` 5. Add regression tests covering directory names that begin with `-`, contain spaces, and contain newline characters. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description claims a Puter deployment/update skill with workflow support for publishing, updating, troubleshooting, and rollback. The actual code only verifies that a given URL returns HTTP 200 and optionally contains expected content. While this could be a supporting verification step within a deployment workflow, the supplied code chunk does not implement the declared primary purpose and lacks any Puter-specific deployment behavior. Therefore, the description materially overstates what the code actually does.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes shell scripts and external CLI commands but does not declare any tool scope or allowed-tools restrictions. That omission weakens execution boundaries and can allow broader-than-expected command execution if the agent framework defaults to permissive shell access, which is risky in a deployment-oriented skill that touches remote targets.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This markdown file instructs the user to package build output, call a deployment endpoint, and poll status, which can send user files and deployment metadata to a remote service. Under the markdown-specific warning rule, the description should explicitly warn about network transmission and its impact on user data or system integrity.

Static analysis

No suspicious patterns detected.