T03 · Remote Payload Retrieval and Execution
Error
- Location
references/azion-cli.md:15- Finding
Unverified Remote Installer Is Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
Azion Deploy
Security checks for vulnerabilities and agentic risk
Overview
This Azion deployment skill is purpose-aligned, but its documentation and wrapper use risky installer and token-handling patterns that users should review before installing.
Install only if you are comfortable reviewing and hardening the Azion setup steps: avoid piping installers directly into a shell, do not source untrusted .env files, prefer secure secret injection or an authenticated CLI session over literal --token arguments, and use least-privileged Azion tokens for deployment.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
references/azion-cli.md:45- Finding
Documentation Executes Project-Controlled .env Files as Shell Code
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/azion-deploy.sh:32- Finding
Azion Authentication Tokens Are Exposed Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (7)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Fetching and immediately executing an external install script is a classic supply-chain risk because it trusts remote content at execution time without verification. In this skill context, the danger is elevated because the file is operational guidance intended to be copied and run by users on developer workstations or CI runners.
- Content
macOS / Linux:
bash curl -fsSL https://downloads.azion.com/cli/install.sh | shWindows (PowerShell):
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The command chains a network fetch directly into a shell using a pipe, removing any opportunity for review or integrity validation before execution. This chaining pattern magnifies the blast radius of any compromise of the download source and is especially risky in deployment-oriented docs where users may run commands with elevated privileges or in automated environments.
- Content
macOS / Linux:
bash curl -fsSL https://downloads.azion.com/cli/install.sh | shWindows (PowerShell):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash set -a source .env set +a azion whoami --token "$AZION_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash set -a source .env set +a azion whoami --token "$AZION_TOKEN"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation instructs users to install the CLI by piping a remotely fetched script directly into a shell/PowerShell interpreter, with no integrity verification, pinning, or warning. If the vendor host, CDN, DNS, TLS trust chain, or network path is compromised, arbitrary code would execute immediately on the user's machine.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The token-based authentication examples normalize loading a sensitive API token from a local .env file and passing it on the command line without any guidance on secrecy, shell history, CI log exposure, or file permissions. While the examples do not directly exfiltrate the token, they encourage handling patterns that can lead to accidental credential disclosure in shared terminals, scripts, or build logs.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Common Failure Patterns - `open .edge/manifest.json` or `open .edge/worker.js`: run `azion build` first. - `Missing default entry point .../handler.js`: create `handler.js` for `javascript` preset. - `~/.npm/_npx/.../package.json` ENOENT during build: clear `~/.npm/_npx` and rerun. - Remote deploy logs failing with `rclone` auth/API version errors: use local deploy (`--local --skip-build`). - Deploy says `.edge/storage` is missing: no static files were uploaded.
Static analysis
No suspicious patterns detected.