Security audit

GTM Tools

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned but asks agents to create long-lived GTM credentials, install an unverified browser-session helper, and use broad social and billing tools without enough consent gates.

Review this skill carefully before installing. Only use it where agents are allowed to create external GTM credentials, spend tokens, connect real LinkedIn or Reddit sessions, and perform public or account-changing actions. Avoid running the extension installer unless you can verify what it downloads and how to uninstall or revoke access.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:77
Finding: Unverified Remote Installer Executed Directly Through Bash
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, line 77
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://api.gtm-tools.sh/extension/install.sh | bash

Technical Analysis

The installation instructions download a mutable shell script from an external server and immediately execute it with Bash. The response is not inspected, pinned to a specific version, verified against a checksum, or authenticated through a cryptographic signature.

Although HTTPS protects the connection in transit, it does not ensure that the server-controlled script remains identical to the version considered during this audit. Compromise of the hosting server, deployment pipeline, domain, or maintainer account—or an intentional subsequent modification—could turn the endpoint into an arbitrary-code delivery mechanism.

The repository does not contain a reviewable copy of install.sh; therefore, the installer's actual commands, filesystem effects, browser modifications, credential access, persistence behavior, and privilege requirements cannot be established from the audited artifact. Direct shell execution exceeds the minimum privilege required to provide extension-installation guidance. A pinned browser-store package or a downloaded and independently verified artifact would provide a narrower trust boundary.

Attack Path

A user or agent follows the instructions to connect a LinkedIn or Reddit browser session.

The shell retrieves the current content served from https://api.gtm-tools.sh/extension/install.sh.

The downloaded response is passed directly to Bash without validation or an opportunity for review.

If the endpoint or its delivery infrastructure has been compromised, attacker-controlled commands execute with the privileges of the invoking user.

Those commands could inspect or alter accessible files, environment variables, API configuration, or browser-related ...[truncated 921 chars]
Remediation: View remediation
Remediation Suggestions

Remove the direct curl | bash pipeline.

Distribute the extension through a trusted browser extension store where possible, and link users to a fixed publisher identity.

If a shell installer is necessary, publish immutable, versioned release artifacts rather than a mutable endpoint.

Require users to download the installer separately and verify a pinned SHA-256 digest and a cryptographic signature before execution.

Keep a reviewable copy of the installer in the repository or link to its exact source revision.

Document all files, browser settings, network endpoints, and permissions modified by the installer.

Ensure the installer runs without elevated privileges unless a narrowly defined operation genuinely requires them.

Require explicit user confirmation before installation and before any permission-sensitive browser-session connection.

Add reproducible release procedures and protect the signing and deployment pipelines with strong access controls.

Provide uninstall and credential-revocation instructions for incident recovery.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Fetching an installer script from a remote server and executing it creates a classic supply-chain and remote-code-execution risk. Because the script is not pinned, verified, or reviewed before execution, any compromise in the delivery path can lead to arbitrary code running on the host.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
Empty list means the user must install the extension and press Connect:

bash
curl -fsSL https://api.gtm-tools.sh/extension/install.sh | bash

Each ready row carries a linkedin_username / reddit_username — pass it as senderUsername to write tools. Both tools cost 0, so checking is always free.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The command chains network retrieval directly into shell execution, eliminating any opportunity to inspect content before it runs. This sharply amplifies exploitation impact because a single manipulated HTTP response can immediately result in arbitrary command execution with the user's privileges.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
Empty list means the user must install the extension and press Connect:

bash
curl -fsSL https://api.gtm-tools.sh/extension/install.sh | bash

Each ready row carries a linkedin_username / reddit_username — pass it as senderUsername to write tools. Both tools cost 0, so checking is always free.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
A human is present — send a verification code, then redeem it:

bash
curl -s -X POST "https://api.gtm-tools.sh/api/v0/get_api_key" \ -H "Content-Type: application/json" \ -d '{"email":"you@yourcompany.com"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: Although external transmission is normally expected here, this specific endpoint initiates autonomous identity registration and returns a long-lived access token. In context, the danger is not mere egress but enabling unsupervised account creation and credential acquisition by an agent.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
→ { "api_key": "sk_..." }

text
**No human is present** — register autonomously via the [auth.md](https://api.gtm-tools.sh/auth.md) protocol. One call, no signup form, own isolated workspace, 100 free tokens: ```bash curl -s -X POST "https://api.gtm-tools.sh/agent/identity" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs agents to autonomously create an account and obtain a bearer token with no user-facing consent or warning. In an agent context, this can cause unauthorized third-party account creation and credential issuance, expanding external access and enabling follow-on actions against the service under newly created credentials.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This call sends a request that yields a bearer token for a new workspace, effectively granting external service access to the agent. In the context of agent skills, automatically obtaining and using such credentials can enable unauthorized external actions and downstream abuse.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
No human is present — register autonomously via the auth.md protocol. One call, no signup form, own isolated workspace, 100 free tokens:

bash
curl -s -X POST "https://api.gtm-tools.sh/agent/identity" \ -H "Content-Type: application/json" \ -d '{"type":"anonymous"}' # → { "access_token":"sk_...", "token_type":"bearer", "expires_in":31536000, ... }

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill recommends piping a remotely fetched script directly into bash without any integrity verification or warning. This creates a direct remote-code-execution path where compromise of the host, CDN, DNS, or transport assumptions would immediately execute attacker-controlled code on the user's system.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: This external fetch is not merely network communication; it downloads executable installer content that is immediately run. In context, the combination of remote retrieval and execution substantially increases the risk of system compromise if the source is tampered with or implicitly trusted.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
Empty list means the user must install the extension and press Connect:

bash
curl -fsSL https://api.gtm-tools.sh/extension/install.sh | bash

Each ready row carries a linkedin_username / reddit_username — pass it as senderUsername to write tools. Both tools cost 0, so checking is always free.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The skill frames usage as 'call any tool' across a large external action surface including LinkedIn, Reddit, email-finding, and related operations, with no apparent allowlist, policy gate, or least-privilege guidance. In an agent setting, unrestricted invocation can enable abusive automation, excessive data access, or execution of costly/high-impact actions under a valid token.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
Each `ready` row carries a `linkedin_username` / `reddit_username` — pass it as `senderUsername` to write tools. Both tools cost 0, so checking is always free. ## How to call any tool Every tool is the same shape. Tool name in the path, JSON body, bearer header:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
Every tool is the same shape. Tool name in the path, JSON body, bearer header:

bash
curl -s -X POST "https://api.gtm-tools.sh/api/v0/TOOL_NAME" \ -H "Authorization: Bearer $GTM_TOOLS_API_KEY" \ -H "Content-Type: application/json" \ -d '{...arguments...}' | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
# GTM Tools — full tool catalog Every tool is `POST https://api.gtm-tools.sh/api/v0/<tool_name>` with `Authorization: Bearer $GTM_TOOLS_API_KEY` and a JSON body. The same names are exposed over MCP at `https://api.gtm-tools.sh/mcp`. Costs are in tokens ($1 = 100 tokens). They are correct as of this writing, but `get_token_balance` returns the live table — prefer it over hardcoding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
# GTM Tools — full tool catalog Every tool is `POST https://api.gtm-tools.sh/api/v0/<tool_name>` with `Authorization: Bearer $GTM_TOOLS_API_KEY` and a JSON body. The same names are exposed over MCP at `https://api.gtm-tools.sh/mcp`. Costs are in tokens ($1 = 100 tokens). They are correct as of this writing, but `get_token_balance` returns the live table — prefer it over hardcoding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
# GTM Tools — full tool catalog Every tool is `POST https://api.gtm-tools.sh/api/v0/<tool_name>` with `Authorization: Bearer $GTM_TOOLS_API_KEY` and a JSON body. The same names are exposed over MCP at `https://api.gtm-tools.sh/mcp`. Costs are in tokens ($1 = 100 tokens). They are correct as of this writing, but `get_token_balance` returns the live table — prefer it over hardcoding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
# GTM Tools — full tool catalog Every tool is `POST https://api.gtm-tools.sh/api/v0/<tool_name>` with `Authorization: Bearer $GTM_TOOLS_API_KEY` and a JSON body. The same names are exposed over MCP at `https://api.gtm-tools.sh/mcp`. Costs are in tokens ($1 = 100 tokens). They are correct as of this writing, but `get_token_balance` returns the live table — prefer it over hardcoding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
# GTM Tools — full tool catalog Every tool is `POST https://api.gtm-tools.sh/api/v0/<tool_name>` with `Authorization: Bearer $GTM_TOOLS_API_KEY` and a JSON body. The same names are exposed over MCP at `https://api.gtm-tools.sh/mcp`. Costs are in tokens ($1 = 100 tokens). They are correct as of this writing, but `get_token_balance` returns the live table — prefer it over hardcoding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
# GTM Tools — full tool catalog Every tool is `POST https://api.gtm-tools.sh/api/v0/<tool_name>` with `Authorization: Bearer $GTM_TOOLS_API_KEY` and a JSON body. The same names are exposed over MCP at `https://api.gtm-tools.sh/mcp`. Costs are in tokens ($1 = 100 tokens). They are correct as of this writing, but `get_token_balance` returns the live table — prefer it over hardcoding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/tools.md (reported line 3)May include surrounding context.
md
# GTM Tools — full tool catalog Every tool is `POST https://api.gtm-tools.sh/api/v0/<tool_name>` with `Authorization: Bearer $GTM_TOOLS_API_KEY` and a JSON body. The same names are exposed over MCP at `https://api.gtm-tools.sh/mcp`. Costs are in tokens ($1 = 100 tokens). They are correct as of this writing, but `get_token_balance` returns the live table — prefer it over hardcoding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The catalog exposes multiple state-changing and externally impactful operations such as sending LinkedIn messages, Reddit messages/comments/posts, voting, subscribing, and billing/account-management actions without any embedded warning that they modify external accounts, spend tokens, or can trigger real-world consequences. In an agent skill context, this increases the risk that an autonomous or semi-autonomous agent invokes these tools without explicit user confirmation, causing unwanted outreach, reputation damage, or financial/account changes.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

External Script Fetching

Chaining Abuse

External Transmission

External Transmission

→ { "api_key": "sk_..." }

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Unrestricted Tool Access

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings