T09 · Insecure Skill Coding Practices
- Location
install.sh:17- Finding
Undisclosed Installation Telemetry and Persistent Shell Profile Modification
- Content
View full analysis
Vulnerability Details
File Location:
install.sh, lines 17–22
Vulnerability Type: Undisclosed external telemetry and unsafe persistent configuration modification
Risk Level: MediumVulnerable Code
bash # Add to PATH grep -q '~/.local/bin' "${HOME}/.zshrc" 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" # Fire install ping (no auth needed — tracks community installs) curl -s -m 5 -X POST "https://api.signalloomai.com/v1/analytics/install" \ -H "Content-Type: application/json" \ -d "{\"skill\":\"${SKILL_SLUG}\",\"version\":\"${VERSION}\",\"source\":\"clawhub\"}" &Technical Analysis
The installer performs two side effects that are not disclosed in
SKILL.md:- It permanently appends a PATH modification to the user's
.zshrc. - It sends an installation event to
https://api.signalloomai.com/v1/analytics/install.
The telemetry request is launched in the background, uses silent mode, and does not ask for user consent. Its explicit JSON payload contains only the skill identifier, version, and installation source; no credentials, job history, or other sensitive local content is included. Nevertheless, the remote service can observe ordinary request metadata such as the source IP address and request time.
The
.zshrcmodification persists across future shell sessions. Automatically adding$HOME/.local/binto PATH can also increase exposure to command-resolution risks if an attacker can place a malicious executable in that directory. The script itself does not place such an executable there, so this is a hardening concern rather than evidence of a bundled command-hijacking payload.The background request and suppressed output reduce transparency and can prevent users from noticing telemetry failures or understanding that an external request was made.
Attack Path
- A user downloads the package and executes
install.sh. - The script cr ...[truncated 1288 chars]
- It permanently appends a PATH modification to the user's
- Remediation
View remediation
Remediation Suggestions
- Clearly disclose telemetry in
SKILL.mdand installation documentation, including the endpoint, data fields, purpose, retention policy, and applicable privacy policy. - Require explicit opt-in consent before transmitting analytics. Alternatively, disable telemetry by default and support a documented flag such as
--enable-telemetry. - Provide a straightforward opt-out environment variable, for example
SIGNALLOOM_TELEMETRY_DISABLED=1. - Avoid silently suppressing request errors. If telemetry is enabled, report whether the request succeeded without exposing secrets.
- Do not modify
.zshrcautomatically. Instead, print the required PATH command and let the user add it manually. - If automatic profile modification remains necessary, request confirmation, create a backup, add clearly marked begin/end comments, detect equivalent PATH configurations robustly, and provide an uninstall procedure.
- Verify ownership and permissions of
$HOME/.local/binbefore recommending it in PATH, and advise users not to allow untrusted accounts or processes to write to that directory. - Keep package metadata consistent:
install.shdeclares version1.0.2, whilepackage.jsondeclares1.0.1. - Add or remove the missing
./scripts/jobauditexecutable referenced bypackage.jsonso the distributed package matches its documented functionality.
- Clearly disclose telemetry in