Security audit

puter-deployer

Security checks for vulnerabilities and agentic risk

Overview

This Puter deployment skill is mostly coherent, but its helper scripts accept unvalidated command inputs that could make local tools access or alter unintended resources.

Review this skill before installing. Use it only with trusted project paths, ordinary build-directory names, and verified HTTPS deployment URLs you control. Be especially careful with the API fallback because it can upload build artifacts using the active Puter account. The scripts should be hardened with URL validation, curl --, and build-directory canonicalization before routine use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/verify_url.sh:4
Finding: Curl Option Injection Through an Unvalidated Verification URL
Content: View full analysis
[expected_snippet]}" SNIPPET="${2:-}" TMP="$(mktemp)" CODE=$(curl -sSL -o "$TMP" -w "%{http_code}" "$URL" || true) ``` ### Technical Analysis The script passes the user-controlled `URL` argument directly to `curl` without first validating it and without using the `--` end-of-options delimiter. Shell quoting prevents word splitting and shell metacharacter interpretation, but it does not prevent the invoked program from interpreting an argument beginning with `-` as a command-line option. Consequently, a value such as `--config=/path/to/file` or an equivalent short option can be interpreted as a curl option rather than as a URL. If an attacker can place or reference a crafted curl configuration file, that configuration can specify additional URLs, uploads, proxy settings, request headers, output destinations, or local file URLs. The script also lacks restrictions on URL schemes and destinations. This makes the option-injection weakness more consequential and permits requests to unintended internal or local resources if malicious curl behavior is introduced. ### Attack Path 1. An attacker influences the URL supplied to `verify_url.sh`. 2. The attacker supplies an option-shaped value, such as a curl configuration directive referencing a crafted or attacker-controlled local configuration file. 3. The script passes the value to `curl` without an option terminator. 4. Curl interprets the value as an option instead of a deployment URL. 5. Directives from the referenced configuration can cause unintended network requests, local-file access, file uploads, or writes to attacker-selected paths. 6. These operations execute with the filesystem and network privileges of the user or Agent running the Skill. ### Impact Assessment Successful explo ...[truncated 541 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/preflight.sh:4
Finding: Find Expression Injection Through an Option-Shaped Build Directory
Content: View full analysis
/dev/null || { echo "FAIL: puter CLI not found"; exit 2; } echo "[2/5] checking puter auth" if ! puter whoami >/dev/null 2>&1; then echo "FAIL: puter not authenticated. Run: puter login" exit 3 fi echo "[3/5] checking build dir" [ -d "$BUILD_DIR" ] || { echo "FAIL: build dir missing: $BUILD_DIR"; exit 4; } echo "[4/5] checking build dir non-empty" find "$BUILD_DIR" -mindepth 1 -print -quit | grep -q . ``` ### Technical Analysis Although `"$BUILD_DIR"` is correctly quoted against shell word splitting, `find` performs its own argument parsing. A build-directory name beginning with `-` can therefore be interpreted as a `find` expression, option, or action instead of a filesystem path. The preceding `[ -d "$BUILD_DIR" ]` check does not eliminate this issue because Unix files and directories may legally have names beginning with a hyphen. If an option-shaped directory exists, it can pass the directory test and then be interpreted differently by `find`. A particularly dangerous GNU `find` action is `-delete`. If an attacker creates a directory with that name and supplies `-delete` as the build-directory argument, `find` can treat it as an action rather than the intended starting path. Depending on the implementation and resulting expression, processing may begin from the current directory and perform destructive operations. The script runs after changing into the supplied project directory, so affected files can include project source and build artifacts. ### Attack Path 1. An attacker creates or causes the project to contain a directory with an option-shaped name, such as `-delete`. 2. The attacker causes the preflight script to be invok ...[truncated 951 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description claims a Puter deployment/update skill with workflow support for publishing, updating, troubleshooting, and rollback. The actual code only verifies that a given URL returns HTTP 200 and optionally contains expected content. While this could be a supporting verification step within a deployment workflow, the supplied code chunk does not implement the declared primary purpose and lacks any Puter-specific deployment behavior. Therefore, the description materially overstates what the code actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes shell scripts and external CLI commands but does not declare any tool scope or allowed-tools restrictions. That omission weakens execution boundaries and can allow broader-than-expected command execution if the agent framework defaults to permissive shell access, which is risky in a deployment-oriented skill that touches remote targets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file instructs the user to package build output, call a deployment endpoint, and poll status, which can send user files and deployment metadata to a remote service. Under the markdown-specific warning rule, the description should explicitly warn about network transmission and its impact on user data or system integrity.
Content: No source excerpt is available for this finding.