mp2rss

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 0.2.2

Overview

The skill’s main purpose is coherent, but its install and update paths ask users to trust mutable remote code and can change local agent skills across sessions.

Review the install path carefully before installing. Prefer a version-pinned release with published checksums or signatures, avoid curl-to-shell, and do not run global skill sync or self-update unless you trust the publisher and understand it may change future agent behavior.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:91
• Finding: Mutable Remote Installation Script Is Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `README.md:91-100`; duplicated in `references/install.md:23-30` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code From `README.md:91-100`: ```bash # Method A: npm (recommended, consistent across platforms) pnpm add -g @mp2rss/cli # Method B: macOS / Linux one-click script curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh ``` The same unsafe installation command appears in `references/install.md:23-30`: ```bash ### B. One-click script (macOS / Linux) ```bash curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh ``` Automatically selects the corresponding macOS or Linux binary and installs it into `/usr/local/bin` or `~/.local/bin`. ``` ### Technical Analysis The installation instructions download a shell script from the mutable `main` branch of a personal GitHub repository and immediately pipe it into `sh`. This creates a remote code-execution channel whose effective payload can change after the Skill package has been reviewed. The downloaded script is not included in the audited project. Consequently, its behavior, download validation, filesystem changes, and privilege handling cannot be verified from this artifact. The instructions do not pin an immutable commit or release, verify a cryptographic signature, check a trusted SHA-256 digest, or provide an inspection step before execution. Installing the CLI is necessary for the declared functionality, but executing a mutable remote script without verification is not necessary and exceeds the minimum-risk installation process. ### Attack Path 1. An attacker compromises the GitHub account, repository, branch protection, or another component capable of modifying `scripts/install.sh` on the `main` branch. 2. The attacker changes the installer to include arbitrary shell commands while retaining expected i ...[truncated 1080 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl ... | sh` installation method from both `README.md` and `references/install.md`. 2. Direct users to a specific, versioned release rather than the mutable `main` branch. 3. Publish SHA-256 checksums through an authenticated release process and require verification before extraction or execution. 4. Prefer cryptographic release signatures, such as Sigstore/cosign or GPG signatures, and document verification against a pinned publisher identity. 5. Use a staged installation process: ```bash curl -fL -o mp2rss.tar.gz https://github.com/areyoubugcoder/mp2rss-cli/releases/download/vX.Y.Z/mp2rss_OS_ARCH.tar.gz echo "<trusted-sha256> mp2rss.tar.gz" | sha256sum -c - tar -xzf mp2rss.tar.gz install -m 0755 mp2rss "$HOME/.local/bin/mp2rss" ``` 6. If a script remains available, require users to download it, verify its signature or pinned digest, inspect it, and execute it separately. 7. Do not instruct Agents to perform installation automatically without explicit user approval. ]]>

T08 · Insecure Dependencies

Error

• Location: references/install.md:15
• Finding: Unpinned Installers, Self-Updates, and Skill Synchronization Create an Unsafe Supply Chain<![CDATA[ ## Vulnerability Details **File Location**: `references/install.md:15-21`, `references/install.md:53-75`; related command exposure in `SKILL.md:177-178` **Vulnerability Type**: Insecure dependency and update mechanism **Risk Level**: High ### Vulnerable Code From `references/install.md:15-21`: ```bash ### A. npm (recommended, consistent across platforms) ```bash pnpm add -g @mp2rss/cli # or npm install -g @mp2rss/cli ``` The `postinstall` script automatically downloads the corresponding Go binary for the platform and binds it as the global `mp2rss` command. ``` From `references/install.md:53-75`: ```bash mp2rss update # Check and upgrade to the latest version mp2rss update --check # Check only mp2rss update --skip-skills # Upgrade without synchronizing local Agent Skills ``` ```bash mp2rss skills sync # Synchronize to ./.agents/skills mp2rss skills sync --global # Synchronize globally to ~/.claude/skills mp2rss skills status [-o json] # Compare local Skill and CLI versions mp2rss skills list [-o json] # List repository-provided Skills ``` The documented behavior further states: ```text After installation through skills sync, mp2rss update will also synchronize Skills to the new version unless --skip-skills is used. The underlying command is: npx -y skills add areyoubugcoder/mp2rss-cli -y ``` Related commands are exposed in `SKILL.md:177-178`: ```text mp2rss update [--check] [--skip-skills] mp2rss skills sync [--global] / status / list ``` ### Technical Analysis The recommended package installation does not pin an exact package version and explicitly relies on a package `postinstall` hook to retrieve a native executable. The downloaded binary and post-installation implementation are not part of this audited Skill package, and the documentation provides no checksum or signature verification procedure. The self-update command downloads a newer executable from GitHub Releases and replaces ...[truncated 2765 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin package installations to an explicitly reviewed version: ```bash npm install -g @mp2rss/cli@X.Y.Z ``` 2. Publish and verify cryptographic checksums and signatures for every platform binary downloaded by the package lifecycle script. 3. Avoid downloading executable content from `postinstall`. Prefer platform-specific packages containing the reviewed binary, or require a separate, explicit installation command. 4. Make updates opt-in and version-specific. Display the exact source version, destination version, artifact digest, and signature status before replacement. 5. Separate binary updates from Agent Skill synchronization. A CLI update must not modify Skill instructions by default. 6. Require explicit confirmation before every project-level or global Skill synchronization. 7. Pin synchronized Skill content to an immutable commit or signed release instead of a mutable repository reference. 8. Replace `npx -y` with a version-pinned command and retain an interactive review step: ```bash npx skills@<reviewed-version> add areyoubugcoder/mp2rss-cli#<immutable-commit> ``` 9. Document rollback procedures and preserve the previous verified binary and Skill revision until the new version is validated. 10. Recommend unprivileged, user-local installation rather than root or administrator execution. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Chaining Abuse

High

• Category: Tool Misuse

Content

pnpm add -g @mp2rss/cli

# 方式 B：macOS / Linux 一键脚本
curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh
```

也可在 [Releases](https://github.com/areyoubugcoder/mp2rss-cli/releases/latest) 下载对应平台二进制。

• Confidence: 97% confidence
• Finding: Piping downloaded content directly into `sh` creates a classic command-execution chain with no inspection or integrity verification step. In the context of an agent skill README, this is more dangerous because users may copy-paste installation commands verbatim, leading to immediate remote code execution if the source is altered or malicious.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 方式 B：手动
mkdir -p ~/.openclaw/workspace/skills/mp2rss
cd ~/.openclaw/workspace/skills/mp2rss
curl -sL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/openclaw/mp2rss/SKILL.md -o SKILL.md
curl -sL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/openclaw/mp2rss/package.json -o package.json
# 视需要再拉 references/ 子文档
```

• Confidence: 60% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

### B. 一键脚本（macOS / Linux）

```bash
curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh
```

自动选 macOS / Linux 对应平台二进制，安装到 `/usr/local/bin` 或 `~/.local/bin`。

• Confidence: 99% confidence
• Finding: The `| sh` construct turns remotely fetched content directly into shell commands, removing any opportunity for review and making command-chaining abuse trivial. If the remote content is altered or intercepted, the user executes attacker-controlled commands immediately, potentially with elevated privileges depending on the environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw skills install mp2rss

# 方式 B：手动
mkdir -p ~/.openclaw/workspace/skills/mp2rss
cd ~/.openclaw/workspace/skills/mp2rss
curl -sL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/openclaw/mp2rss/SKILL.md -o SKILL.md
curl -sL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/openclaw/mp2rss/package.json -o package.json

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file states that the human-readable message is in Chinese and can be directly forwarded to the user. Later guidance reinforces not translating the message, which effectively forces Chinese output regardless of user preference or locale.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The instruction says to forward `error.message` directly and not translate it into the agent's own description. Because the document elsewhere specifies these messages are Chinese, this creates a fixed-language behavior without offering user opt-in or locale choice.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The document recommends piping a remote script from GitHub directly into `sh` with no verification or explicit warning. This is dangerous because any compromise of the repository, branch, transport endpoint, or fetched content immediately becomes arbitrary shell execution on the user's system.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The documentation instructs use of `npx -y skills add ...` without pinning an exact package version or integrity, so execution depends on whatever package version is current at install time. That creates a supply-chain risk: a compromised upstream package, typosquat, or malicious new release could cause arbitrary code execution on the user's machine during skill installation.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

CLI 自更新只替换二进制，本地已安装的 Agent Skills 不会自动跟着升级。CLI ≥ 1.2.0 内置同步命令（旧版本无此命令，继续用 `npx -y skills add areyoubugcoder/mp2rss-cli -y`）：

```bash
mp2rss skills sync              # 同步到当前项目 ./.agents/skills
mp2rss skills sync --global     # 同步到全局 ~/.claude/skills
mp2rss skills status [-o json]  # 本地 skills 版本 vs CLI 版本，是否漂移
mp2rss skills list [-o json]    # 列出仓库提供的 skills

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This line again references `npx -y skills add ...` without a pinned version, meaning users may execute newly published code from the registry with no version lock. In a security-sensitive installation path, that is a real supply-chain exposure because package content can change independently of this documentation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The entire skill file is written as Chinese-only operational guidance, with no indication that the agent should adapt to the user's preferred language or that this skill is intentionally limited to Chinese-speaking contexts. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The skill description and all user interaction examples are presented in Chinese, which can imply the skill expects or operates in a specific language. There is no statement that other languages are supported or that Chinese is required for a documented region-specific reason, so this is a natural-language locale policy concern.

External Script Fetching

Low

• Category: Supply Chain

Content

pnpm add -g @mp2rss/cli

# 方式 B：macOS / Linux 一键脚本
curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh
```

也可在 [Releases](https://github.com/areyoubugcoder/mp2rss-cli/releases/latest) 下载对应平台二进制。

• Confidence: 96% confidence
• Finding: The README instructs users to fetch and execute a remote shell script with `curl ... | sh`, which trusts live network content at execution time. If the upstream repository, branch, CDN path, or transport chain is compromised, arbitrary code can run on the user's machine immediately during installation.

External Script Fetching

Low

• Category: Supply Chain

Content

### B. 一键脚本（macOS / Linux）

```bash
curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh
```

自动选 macOS / Linux 对应平台二进制，安装到 `/usr/local/bin` 或 `~/.local/bin`。

• Confidence: 97% confidence
• Finding: Fetching and executing an external script from a live URL is a real security risk because the executed content is not fixed, locally reviewed, or integrity-checked. In this skill context, the risk is elevated because the instructions are for installation, where users are primed to grant broad trust and shell access.

Static analysis

No suspicious patterns detected.