Kleo Static files

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:27 AM UTC
• Version: 1.0.0

Overview

This appears to be a real static hosting skill, but its install path asks users to run unverified internet scripts as root and creates a persistent service with excessive privileges.

Review carefully before installing. Do not run the one-line curl-to-sudo installer on a production or sensitive host unless you first download, inspect, and verify a pinned release. Prefer a dedicated low-privilege service account, locked-down .env permissions, pinned dependencies, and explicit backups or confirmation before delete or clean-deploy operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:195

Finding

Mutable Remote Installer Executed Directly as Root

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Error

• Location: references/install.md:75

Finding

Boot-Persistent Service Executes Repository-Controlled Application Code

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/install.md:22

Finding

Bun Installer Downloaded and Executed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/install.md:33

Finding

Unpinned Repository and Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sf-helper.sh:11

Finding

Environment-Controlled Command Selection in Helper Script

Content

View full analysis

/dev/null | grep -q "\"name\":\"$site\""; then echo "Creating site: $site" $SF_CLI sites create "$site" fi if [ -n "$auth" ]; then echo "Setting authentication..." $SF_CLI sites auth "$site" "$auth" fi $SF_CLI upload "$dir" "$site" --overwrite ``` ```bash $SF_CLI sites delete "$site" 2>/dev/null || true $SF_CLI sites create "$site" $SF_CLI upload "$dir" "$site" ``` ```bash $SF_CLI sites list --json 2>/dev/null | \ grep -o '"name":"[^"]*"' | \ cut -d'"' -f4 ``` ### Technical Analysis The `SF_CLI` environment variable controls which executable is launched. It is expanded without quotation or validation at every invocation. Shell word splitting allows the variable to contain an executable followed by attacker-selected arguments rather than a single validated command path. For example, an attacker who can control the helper's environment could set `SF_CLI` to a shell interpreter and arguments that execute another command. The helper also inherits `SF_API_KEY`, so an attacker-selected executable can read that credential directly from the process environment. This issue requires the attacker to influence the environment or invocation context. It does not independently provide remote access, but it creates an exploitable trust boundary in automation, shared shells, CI jobs, and agent-controlled execution environments. ### Attack Path 1. An attacker gains the ability to define environment variables for a process that will invoke `sf-helper.sh`, such as through a CI configuration, wrapper script, poisoned shel ...[truncated 1054 chars]

Remediation

View remediation

&2; exit 1 ;; esac [ -f "$SF_CLI" ] && [ -x "$SF_CLI" ] || { echo "Error: invalid SF_CLI executable" >&2 exit 1 } "$SF_CLI" sites list --json ``` - Sanitize the environment in privileged automation and CI jobs. - Store API credentials using a restricted secret mechanism and expose them only to the exact process that requires them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (36)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Update Existing Files

bash

# Overwrite existing file
sf upload ./new-version.pdf mysite --overwrite

# Or delete and re-upload

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

- `path`: File or directory to upload
- `site`: Target site name
- `subdir`: Optional subdirectory
- `--overwrite`: Replace existing files
- `--json`: Output JSON

### files

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The 'curl | sudo bash' pattern combines remote content retrieval with immediate privileged execution, creating a high-risk chaining primitive that removes review barriers and amplifies compromise impact. In this skill's installation context, it is especially dangerous because users are explicitly told to run it once on the host, making full host compromise plausible if the fetched script is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

Server Installation (run once on host)

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

The installer outputs JSON with connection details between KLEO_SF_CONFIG_BEGIN and KLEO_SF_CONFIG_END markers. Parse this to get api_url and api_key.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping remote content directly into sudo bash combines external fetching, shell interpretation, and root privilege in a single step, eliminating opportunities for review or verification. This materially increases the likelihood and blast radius of supply-chain compromise, enabling full system takeover.

Content

Scanner excerpt · references/install.md (reported line 13)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The Bun installer is fetched from the internet and piped directly to bash without integrity verification. Even without sudo on this specific line, compromise of the installer source can lead to arbitrary code execution in the installing user's context and potentially further privilege escalation.

Content

Scanner excerpt · references/install.md (reported line 22)May include surrounding context.

bash

# Bun
curl -fsSL https://bun.sh/install | bash

# Caddy (Ubuntu/Debian)
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Piping a remotely fetched installer into bash allows arbitrary code execution without review or integrity checks. Although it runs as the current user rather than via sudo, it still gives the remote script full control over that user's environment and can be a stepping stone to broader compromise.

Content

Scanner excerpt · references/install.md (reported line 22)May include surrounding context.

bash

# Bun
curl -fsSL https://bun.sh/install | bash

# Caddy (Ubuntu/Debian)
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/install.md (reported line 25)May include surrounding context.

md

curl -fsSL https://bun.sh/install | bash

# Caddy (Ubuntu/Debian)
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update && sudo apt install caddy

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/install.md (reported line 26)May include surrounding context.

md

curl -fsSL https://bun.sh/install | bash

# Caddy (Ubuntu/Debian)
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update && sudo apt install caddy

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install.md (reported line 26)May include surrounding context.

Caddy (Ubuntu/Debian)

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list sudo apt update && sudo apt install caddy

text

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install.md (reported line 27)May include surrounding context.

Caddy (Ubuntu/Debian)

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list sudo apt update && sudo apt install caddy

text

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install.md (reported line 28)May include surrounding context.

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list sudo apt update && sudo apt install caddy

text

### 2. Clone Repository

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The service consumes secrets from /opt/kleo-static-files/.env, but the guide does not specify restrictive permissions or a dedicated service account. On multi-user systems, weak file permissions could expose API configuration and other secrets to local users or processes, and the same unit also runs Bun from /root, suggesting an unnecessarily privileged deployment model.

Content

Scanner excerpt · references/install.md (reported line 85)May include surrounding context.

md

[Service]
Type=simple
WorkingDirectory=/opt/kleo-static-files
EnvironmentFile=/opt/kleo-static-files/.env
ExecStart=/root/.bun/bin/bun run server/index.ts
ExecStartPost=/opt/kleo-static-files/scripts/sync-caddy.ts --reload
Restart=on-failure

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/install.md (reported line 107)May include surrounding context.

bash

cd /opt/kleo-static-files
source .env
bun run scripts/create-key.ts "admin"
# Save the key!

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents sf files ... delete and sf sites delete operations, including that site deletion removes all files, but it does not provide any explicit warning or caution about irreversibility or potential data loss. Under the markdown-file criteria, destructive behaviors that can affect user data should be accompanied by clear warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill explicitly instructs users to upload sensitive files and share both the URL and credentials, but it does not warn about plaintext credential handling, credential reuse, or the limits of basic auth for protecting sensitive data. This can lead to accidental exposure of confidential material or insecure secret-sharing practices, especially if users copy weak or reused passwords into chat, shells, or logs.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Piping a remotely fetched script directly into sudo bash executes untrusted network content as root without an opportunity to inspect or verify it. If the source repository, network path, or hosting account is compromised, this becomes an immediate root-level remote code execution path on the host.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

Server Installation (run once on host)

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

The installer outputs JSON with connection details between KLEO_SF_CONFIG_BEGIN and KLEO_SF_CONFIG_END markers. Parse this to get api_url and api_key.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 13)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 26)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 27)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 28)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 34)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 60)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 61)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 62)May include surrounding context.

Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/498AS/kleo-static-files/main/install.sh | sudo bash

Manual Install

Static analysis

No suspicious patterns detected.