ClawHub
Back to skill

Security audit

expanso

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a real Expanso cloud-to-local pipeline integration, but its installer and cloud-connected local runtime need careful review before use.

Install only if you trust Expanso's installer domains, cloud service, and marketplace pipelines. Prefer downloading and verifying installer scripts or signed packages before execution, protect the bootstrap token, run the Edge process with least local privilege, and review each deployed pipeline before processing sensitive data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

External Script Fetching

High
Category
Supply Chain
Content
## Step 2: Install Tools

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh
Confidence
98% confidence
Finding
curl -fsSL https://get.expanso.io/edge/install.sh | bash

External Script Fetching

High
Category
Supply Chain
Content
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

## Step 3: Get Bootstrap Credentials
1. In Expanso Cloud, go to Settings → Edge Nodes
Confidence
98% confidence
Finding
curl -fsSL https://get.expanso.io/cli/install.sh | sh

External Script Fetching

High
Category
Supply Chain
Content
primaryEnv: EXPANSO_EDGE_BOOTSTRAP_TOKEN
    requires:
      bins:
        - curl
      env:
        - EXPANSO_EDGE_BOOTSTRAP_URL
        - EXPANSO_EDGE_BOOTSTRAP_TOKEN
Confidence
98% confidence
Finding
curl env: - EXPANSO_EDGE_BOOTSTRAP_URL - EXPANSO_EDGE_BOOTSTRAP_TOKEN install: - curl -fsSL https://get.expanso.io/edge/install.sh | bash

External Script Fetching

High
Category
Supply Chain
Content
- EXPANSO_EDGE_BOOTSTRAP_TOKEN
    install:
      - curl -fsSL https://get.expanso.io/edge/install.sh | bash
      - curl -fsSL https://get.expanso.io/cli/install.sh | sh
    config:
      requiredEnv:
        - name: EXPANSO_EDGE_BOOTSTRAP_URL
Confidence
98% confidence
Finding
curl -fsSL https://get.expanso.io/cli/install.sh | sh

Chaining Abuse

High
Category
Tool Misuse
Content
## Step 2: Install Tools

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh
Confidence
97% confidence
Finding
| bash

Chaining Abuse

High
Category
Tool Misuse
Content
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

## Step 3: Get Bootstrap Credentials
1. In Expanso Cloud, go to Settings → Edge Nodes
Confidence
97% confidence
Finding
| sh

Chaining Abuse

High
Category
Tool Misuse
Content
- EXPANSO_EDGE_BOOTSTRAP_URL
        - EXPANSO_EDGE_BOOTSTRAP_TOKEN
    install:
      - curl -fsSL https://get.expanso.io/edge/install.sh | bash
      - curl -fsSL https://get.expanso.io/cli/install.sh | sh
    config:
      requiredEnv:
Confidence
99% confidence
Finding
| bash

Chaining Abuse

High
Category
Tool Misuse
Content
- EXPANSO_EDGE_BOOTSTRAP_TOKEN
    install:
      - curl -fsSL https://get.expanso.io/edge/install.sh | bash
      - curl -fsSL https://get.expanso.io/cli/install.sh | sh
    config:
      requiredEnv:
        - name: EXPANSO_EDGE_BOOTSTRAP_URL
Confidence
99% confidence
Finding
| sh

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.