cli-hub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:13 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a legitimate CLI catalog, but it encourages broad unpinned installs and sensitive account/browser integrations without enough scoping or consent guidance.

Review this carefully before installing. Prefer installing only the specific CLI you need, avoid matrix installs unless you trust every included provider, use isolated environments where possible, pin and verify package versions, and use least-privilege credentials for tools that touch vaults, browser sessions, cloud APIs, deployment systems, or business accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Package-Manager Bootstrap Enables Unaudited Downstream Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–49 and 383–418
Vulnerability Type: Insecure third-party dependency installation and mutable supply-chain execution
Risk Level: Medium

Complete Code Snippet

markdown

# First, install the CLI Hub package manager
pip install cli-hub-py

# Install any CLI by name
cli-hub install gimp
cli-hub install blender
cli-hub install generate-veo-video

# Install the whole matrix
cli-hub matrix install video-creation

markdown

| **3D & CAD** | Capability-based matrix for 3D modeling, parametric CAD, sculpting, point clouds, photogrammetry, PBR texturing, preview/offline rendering, GPU frame debugging, fabrication (slicing and CAM), and game-engine export. Mostly offline-capable; providers include harness CLIs, Python libs, native binaries, and cloud APIs. | 6 | `cli-hub matrix install 3d-cad` | `cli-hub-matrix/3d-cad/SKILL.md` |
| **Game Development** | Capability-based matrix for game development: engine authoring (Godot-first), 3D/2D/audio/notation assets, AI-generated assets, agent-driven playtesting, build packaging, store publishing, and telemetry/crash reporting. Providers include harness CLIs, public CLIs, Python libs, native binaries, and cloud APIs. | 9 | `cli-hub matrix install game-development` | `cli-hub-matrix/game-development/SKILL.md` |
| **Image & Graphic Design** | Capability-based matrix for image and graphic design: AI image generation, raster/vector editing, UI mockups/wireframes, diagrams, super-resolution upscaling, photo library management, RAW development, and CMS publishing. GIMP/Krita/Inkscape/ComfyUI cover most work offline; cloud APIs escalate quality. | 7 | `cli-hub matrix install image-design` | `cli-hub-matrix/image-design/SKILL.md` |
| **Knowledge / Office / Research** | Capability-based matrix for research, note-taking, document authoring, and publishing: web/literature search, article retrieval, citations/references, n
...[truncated 4084 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cli-hub-py and every downstream package to reviewed, immutable versions.
2. Require cryptographic hashes for Python artifacts, such as a hash-locked requirements file installed with pip --require-hashes.
3. Publish and enforce a signed manifest containing each component's package name, version, registry or repository source, and artifact digest.
4. Verify package signatures, release attestations, checksums, and repository ownership before installation.
5. Avoid global npm installation. Use isolated project-local environments, containers, virtual environments, or dedicated tool directories.
6. Do not execute remote or native installer scripts automatically. Download them for inspection, verify their digest, and require explicit user approval before execution.
7. Make cli-hub display the fully resolved dependency set, versions, sources, requested permissions, and installation method before proceeding.
8. Require separate confirmation for matrix installations because they install multiple independently sourced components.
9. Vendor or snapshot externally referenced Skill documents and audit them together with the parent Skill.
10. Run installed tools with least privilege and restrict filesystem, network, credential, and process access where practical.
11. Add continuous dependency monitoring and revoke or block compromised versions through an allowlist.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file prominently recommends install and launch commands for many tools, including matrix installs that pull multiple dependencies, but does not warn that these actions can install software, invoke third-party installers, and modify the local system. This omission can mislead users or agents into performing broad code-execution and system-change operations without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The catalog advertises many CLIs that access local apps, browser sessions, cookies, notes, storage, APIs, and remote services, including browser automation and secret-management adjacent tooling, without a privacy or credential-handling warning. In this context, the omission is more dangerous because the hub normalizes installation and use of numerous sensitive integrations from a single interface, increasing the chance that an agent or user grants broad access without understanding data exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill includes an install command using npx skills without pinning a specific version or immutable source. That allows execution of whatever package version is current at install time, creating a supply-chain risk where a compromised or updated upstream package could run arbitrary code on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This second npx skills reference has the same issue: it invokes an unpinned package-manager workflow that may fetch and execute changing remote code. In a skill catalog meant for agents, this is especially risky because users may treat documented install commands as trusted and run them automatically.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

md

| Name | Description | Entry Point | Install | Skill |
|------|-------------|-------------|---------|-------|
| **1Password CLI** | Official 1Password CLI for vault access, secrets retrieval, item automation, and desktop-app-backed authentication | `op` | `cli-hub install 1password-cli` | https://developer.1password.com/docs/cli/get-started/ |
| **DeployHQ CLI** | Deploy code, manage projects/servers, run and monitor deployments via the DeployHQ platform — for humans and AI agents | `dhq` | `cli-hub install deployhq` | https://github.com/deployhq/deployhq-cli/blob/main/skills/deployhq/SKILL.md |
| **Sentry CLI** | Official Sentry CLI for releases, sourcemaps, debug files, monitors, and org/project automation | `sentry-cli` | `cli-hub install sentry` | https://docs.sentry.io/cli/ |

### Devtools

Static analysis

No suspicious patterns detected.