expanso

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:50 AM UTC
• Version: 1.0.2

Overview

This skill has a coherent Expanso Edge purpose, but its installer can run mutable remote shell scripts and its cloud/data-boundary disclosures are too broad for a security-sensitive local runtime.

Review this carefully before installing. Do not run the curl-to-shell commands unless you are comfortable trusting the live get.expanso.io installer contents at install time; prefer a signed, pinned, checksum-verified package if available. Treat the bootstrap token as sensitive, rotate or revoke it if exposed, and confirm what Expanso Cloud can see or control before using this with private data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17

Finding

Unverified Remote Installer Scripts Executed Directly by the Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-18 and SKILL.md:49-52
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

yaml

install:
  - curl -fsSL https://get.expanso.io/edge/install.sh | bash
  - curl -fsSL https://get.expanso.io/cli/install.sh | sh

bash

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

Technical Analysis

The skill metadata and setup instructions download mutable scripts from get.expanso.io and pass their contents directly to bash or sh. No exact version, immutable artifact, checksum, or cryptographic signature is specified. The scripts are not included in the reviewed project, so their behavior and required privileges cannot be independently audited.

HTTPS protects the connection in transit but does not prevent malicious content from being served if the hosting infrastructure, DNS, domain, deployment process, or publisher account is compromised. Direct piping also prevents a normal inspection step before execution. Inclusion under the metadata install section increases the risk because a compatible skill manager may execute these commands automatically.

Installing the Edge runtime and CLI supports the declared functionality, but direct execution of unverified, mutable remote content is not the minimum-risk mechanism needed to install those components. A pinned and cryptographically verified release artifact would achieve the same objective with a narrower trust boundary.

Attack Path

1. An attacker compromises the installer domain, DNS resolution, hosting environment, publication pipeline, or an authorized publisher account.
2. The attacker modifies either edge/install.sh or cli/install.sh to include arbitrary shell commands.
3. A user or automated ...[truncated 1176 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace curl | bash and curl | sh with downloads of versioned release artifacts from immutable URLs.
2. Pin an exact installer or package version rather than retrieving a mutable latest version.
3. Publish SHA-256 checksums and, preferably, cryptographic signatures through an independently protected channel.
4. Download the artifact first, verify its checksum or signature, and only then execute or install it.
5. Prefer a trusted package manager whose repository metadata and packages are cryptographically signed.
6. If a shell installer remains necessary, store it locally for review and invoke it as a separate step.
7. Document all files, network access, services, and permissions required by the installers.
8. Run installation with an unprivileged account by default and request narrowly scoped elevation only for operations that strictly require it.
9. Ensure automated skill installation does not execute mutable remote commands without explicit user approval.

T03 · Remote Payload Retrieval and Execution

Error

• Location: INSTALL.txt:9

Finding

Quick-Install Guide Executes Mutable Remote Scripts Without Verification

Content

View full analysis

Vulnerability Details

File Location: INSTALL.txt:9-12
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

Technical Analysis

The quick-install guide instructs users to stream two externally hosted scripts directly into command interpreters. The commands provide no version pinning, checksum validation, signature verification, or opportunity to inspect the downloaded scripts. Because the effective payload is controlled outside this project, it can change after the skill has been reviewed.

The remote installers may be legitimate, but their trustworthiness cannot be established from the audited files. Compromise of any component in the remote publication chain would turn the documented installation process into an arbitrary code-execution channel.

This mechanism exceeds the minimum risk necessary for the declared installation task. Installing the required runtime and CLI is necessary for the documented workflow, but executing mutable and unverified shell content is not.

Attack Path

1. An attacker gains control over an installer response through compromise of the domain, DNS, hosting platform, release pipeline, or publisher credentials.
2. The attacker replaces a legitimate installer response with a script containing malicious commands.
3. A user follows INSTALL.txt and runs one of the supplied commands.
4. The downloaded response is executed immediately by bash or sh, without integrity verification.
5. The payload operates with the invoking account's privileges and can access all resources available to that account.
6. The payload may steal credentials, modify local tools or configuration, retrieve additional malware, or create persistence ...[truncated 568 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove direct shell pipelines from the quick-install instructions.
2. Provide exact, versioned package or release URLs.
3. Supply a trusted checksum and cryptographic signature for every distributed artifact.
4. Require users to download and verify the artifact before installation.
5. Publish explicit verification commands and fail safely if verification does not succeed.
6. Prefer signed operating-system packages or another package manager with authenticated repository metadata.
7. State that installation should occur without administrative privileges unless a documented operation specifically requires elevation.
8. Pin remotely deployed pipeline definitions to immutable versions and verify their provenance before allowing the local Edge runtime to execute them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This command downloads a shell script from an external domain and executes it immediately via bash. In the context of an install guide for a cloud-connected runtime, compromise of the distribution path could yield full code execution on the local host and persistence through installed components.

Content

Scanner excerpt · INSTALL.txt (reported line 9)May include surrounding context.

text

## Step 2: Install Tools

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide tells users to fetch and immediately execute remote shell scripts with no integrity verification, review step, or warning. This creates a direct supply-chain and remote-code-execution risk: if the host, CDN, DNS, TLS trust chain, or publisher account is compromised, arbitrary code runs on the user's machine.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The use of a shell pipe into bash removes any opportunity for meaningful review and turns content retrieval directly into execution. This pattern is especially dangerous in installation docs because users are primed to run it verbatim, magnifying the blast radius of any upstream compromise.

Content

Scanner excerpt · INSTALL.txt (reported line 9)May include surrounding context.

text

## Step 2: Install Tools

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This command has the same external-script execution risk for the CLI installer, again enabling arbitrary code execution if the remote content is altered or intercepted. Because the CLI is used to deploy jobs to cloud infrastructure, compromise could also expose credentials or tamper with later deployments.

Content

Scanner excerpt · INSTALL.txt (reported line 12)May include surrounding context.

text

curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

## Step 3: Get Bootstrap Credentials
1. In Expanso Cloud, go to Settings → Edge Nodes

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Piping the downloaded CLI installer into sh has the same chaining-abuse property: fetched data is immediately trusted as executable code. In this skill's context, that increases danger because the installed tooling interfaces with cloud resources and bootstrap credentials, raising the risk of account compromise as well as host compromise.

Content

Scanner excerpt · INSTALL.txt (reported line 12)May include surrounding context.

text

curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

## Step 3: Get Bootstrap Credentials
1. In Expanso Cloud, go to Settings → Edge Nodes

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The manifest's install workflow fetches a remote script over the network and executes it via shell during setup. If the remote host, delivery path, or script content is compromised, installing the skill can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

primaryEnv: EXPANSO_EDGE_BOOTSTRAP_TOKEN
    requires:
      bins:
        - curl
      env:
        - EXPANSO_EDGE_BOOTSTRAP_URL
        - EXPANSO_EDGE_BOOTSTRAP_TOKEN

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping network-fetched content directly into bash is a classic command-chaining abuse pattern because it collapses retrieval and execution into one step with no validation barrier. In a skill installation context, this gives any compromise of the fetched content immediate execution privileges on the host.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- EXPANSO_EDGE_BOOTSTRAP_URL
        - EXPANSO_EDGE_BOOTSTRAP_TOKEN
    install:
      - curl -fsSL https://get.expanso.io/edge/install.sh | bash
      - curl -fsSL https://get.expanso.io/cli/install.sh | sh
    config:
      requiredEnv:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This second installer command repeats the same unsafe pattern by fetching and executing a shell script directly from a remote server. Because it installs a CLI used for cloud deployment, compromise could also affect later pipeline operations and credentials handled by that tool.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

- EXPANSO_EDGE_BOOTSTRAP_TOKEN
    install:
      - curl -fsSL https://get.expanso.io/edge/install.sh | bash
      - curl -fsSL https://get.expanso.io/cli/install.sh | sh
    config:
      requiredEnv:
        - name: EXPANSO_EDGE_BOOTSTRAP_URL

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using '| sh' has the same chaining-abuse risk as '| bash' and provides no opportunity for verification before execution. Because this installs a deployment CLI, abuse could compromise both the local system and any downstream interactions with the cloud service.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

- EXPANSO_EDGE_BOOTSTRAP_TOKEN
    install:
      - curl -fsSL https://get.expanso.io/edge/install.sh | bash
      - curl -fsSL https://get.expanso.io/cli/install.sh | sh
    config:
      requiredEnv:
        - name: EXPANSO_EDGE_BOOTSTRAP_URL

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The user-facing setup guide instructs direct execution of a remote installer script, creating an obvious remote code execution path if the source or network path is tampered with. Including this in documentation makes the risky behavior more likely to be copied verbatim by users.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

bash

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The documentation normalizes a download-and-execute chain for the Edge runtime, which is dangerous because users often run such commands with full account privileges. Any attacker who can influence the fetched script or its delivery can obtain arbitrary code execution during setup.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

bash

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This command again executes a fetched remote script without verification, extending the attack surface to another component of the toolchain. In the context of a skill that manages deployments, compromise could enable persistent manipulation of jobs, credentials, or subsequent fetched artifacts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

curl -fsSL https://get.expanso.io/edge/install.sh | bash

Install Expanso CLI (deploy to cloud)

curl -fsSL https://get.expanso.io/cli/install.sh | sh

text

### 3. Get a Bootstrap Token

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This documented '| sh' pattern repeats the same unsafe execution chain for the CLI component. Since the CLI is later used to deploy remote pipeline definitions, a compromised install can have ongoing security consequences beyond the initial setup.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

curl -fsSL https://get.expanso.io/edge/install.sh | bash

Install Expanso CLI (deploy to cloud)

curl -fsSL https://get.expanso.io/cli/install.sh | sh

text

### 3. Get a Bootstrap Token

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions place a bootstrap token directly into an environment variable without guidance on secure handling, rotation, or shell-history/process exposure. If the token is leaked through logs, history, screenshots, shared terminals, or process inspection, an attacker may be able to register or control an edge node against the cloud account.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest and description emphasize local data processing, but the documented setup requires registering an Edge node with Expanso Cloud and deploying pipelines through that service. This creates a misleading trust boundary: users may assume an entirely local/offline workflow when metadata, configuration, and deployment control are mediated remotely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation instructions pipe remote content directly into a shell, which prevents users from inspecting what will execute and turns compromise of the distribution endpoint or TLS-terminating environment into immediate code execution. The absence of a warning further normalizes an unsafe installation pattern for a security-sensitive runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The statement that API keys and data 'never leave your machine' is too absolute given the same document requires cloud bootstrap, node registration, and cloud-mediated deployment. Even if payload data is processed locally, such claims can cause users to expose sensitive workflows under false assumptions about what information is transmitted remotely.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This plain-text file provides general-purpose installation and deployment steps but does not define any explicit trigger phrases, scope boundaries, or exclusion conditions for when the associated skill or workflow should be invoked. Under the vague-trigger rule for text files, the absence of specificity can allow overly broad interpretation of when these instructions apply.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The documentation instructs users to connect the local runtime to Expanso Cloud without clearly warning that registration, deployment metadata, and potentially operational telemetry will be transmitted to a remote service. This is primarily a transparency and informed-consent issue, but it can materially affect users handling sensitive environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.