Markster OS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:35 AM UTC
• Version: 1.0.2

Overview

The skill is transparent about being an installer guide, but it directs users to run an unpinned external installer with broad local authority.

Review this before installing. Only proceed if you trust the upstream Markster OS repository and installer. Prefer pinning a specific reviewed commit or signed release, inspect install.sh first, avoid sudo, and run setup in a constrained workspace or disposable environment when possible.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SETUP.md:7

Finding

Execution of an Unpinned Remote Installer

Content

View full analysis

Vulnerability Details

File Location: README.md:20-24, SETUP.md:7-11, and SKILL.md:63-67
Vulnerability Type: Remote payload retrieval and execution through a mutable Git repository
Risk Level: High

Vulnerable Code

The same installation sequence is recommended in all three files:

bash

git clone https://github.com/markster-public/markster-os.git
cd markster-os
bash install.sh

Technical Analysis

The installation flow clones the current default branch of an external GitHub repository and immediately executes its install.sh file. The repository is not pinned to a reviewed commit or immutable release tag, and the instructions do not require signature, checksum, or source verification before execution.

Consequently, the effective installer can change after this skill has been reviewed. If the upstream repository, maintainer account, release process, or GitHub organization is compromised, an attacker can modify install.sh and obtain code execution when a user follows the documented setup flow.

The explicit user-approval requirements in SKILL.md reduce accidental execution but do not establish the integrity of the downloaded code. User consent to installation is not equivalent to consent to execute an unknown or subsequently modified payload.

The pre-scan reference to curl | bash at README.md:37 is not itself executable behavior. It is a documentation rule prohibiting that pattern. The actual concern is the semantically similar clone-and-execute sequence above.

Attack Path

1. An attacker compromises the upstream markster-public/markster-os repository, a maintainer account, or its publication process.
2. The attacker modifies install.sh or another component invoked by that installer.
3. A user requests full installation and grants the approval required by the skill.
4. The agent or user clones the mutable default branch without selecting a verified commit or release. 5 ...[truncated 1362 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to an immutable, reviewed commit hash or cryptographically signed release rather than the repository's mutable default branch.
2. Publish and verify a SHA-256 checksum or a trusted cryptographic signature for the release archive and installer.
3. Separate retrieval from execution. Require the user to inspect install.sh and summarize its operations before allowing it to run.
4. Display the resolved repository URL and commit hash immediately before execution and obtain approval for that exact revision.
5. Avoid running the installer with sudo, administrator rights, or any permissions not strictly required.
6. Run the installer in a constrained environment where practical, such as a disposable container or virtual machine with limited filesystem and credential access.
7. Pin and verify any skills, packages, binaries, or other dependencies subsequently installed by markster-os install-skills.
8. Document the files, network destinations, hooks, and configuration changes made by the installer so users can assess its privilege requirements before execution.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md

Important:

- this package should ask for explicit approval before any install, remote, or push command
- this package should not use `curl | bash`

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- keep raw notes in `learning-loop/inbox/`
- use `markster-os validate .` before claiming the workspace is ready
- if a specialized public skill is needed, list skills first and install explicitly only after user approval
- do not claim native OpenClaw integration beyond the documented setup flow
- do not run install, remote, or push commands without explicit user approval
- make the handoff explicit: after setup, the local `markster-os` skill is the real runtime

Static analysis

No suspicious patterns detected.