put.io (kaput CLI)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward put.io helper that uses a disclosed third-party CLI, with the main caution being that the CLI install is unpinned and unofficial.

Install only if you trust the unofficial kaput CLI and are comfortable granting it access to your put.io account token. Prefer a reviewed pinned version if available, avoid installing or running it with sudo/root, and treat the local token file and any account/status output as sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Installation of an Unofficial Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–20; the dependency is identified as unofficial at line 8
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

- Requires Rust + Cargo.
- Install:
  ```bash
  cargo install kaput-cli
  ```

The documentation separately states:

markdown

This skill uses the unofficial **kaput** CLI to operate put.io from the command line.

Technical Analysis

The documented installation command does not pin kaput-cli to an exact, reviewed version and does not specify a verified source or integrity check. Consequently, users following the instructions may install whichever release currently satisfies Cargo's default selection behavior.

Cargo compiles downloaded packages locally, including any package build logic. A compromised maintainer account, malicious future release, or upstream registry compromise could therefore cause code that was not present during this audit to execute during installation. The risk is elevated because the dependency is explicitly described as unofficial and is expected to handle a locally stored put.io authentication token.

The project scripts correctly quote the resolved executable and supplied arguments; no shell command injection was identified in those wrappers. The issue is specifically the trust and reproducibility of the dependency installation process.

Attack Path

1. An attacker compromises the kaput-cli publishing account, upstream source, or release process.
2. The attacker publishes a malicious new release under the legitimate package name.
3. A user follows the documented cargo install kaput-cli command.
4. Cargo retrieves and compiles the attacker-controlled release without requiring the user to select a previously reviewed version.
5. Malicious build or runtime code executes with the privileges of the installing use ...[truncated 883 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact version that has been reviewed:

   bash

   cargo install kaput-cli --version '=X.Y.Z' --locked
   

2. Document the expected Cargo registry, repository, release tag, and source revision so users can detect package-name confusion or an unexpected source.

3. Verify release provenance using signed release artifacts, registry provenance information, or a separately published trusted checksum where available.

4. Review the pinned package, its lockfile, transitive dependencies, and build scripts before recommending it.

5. Upgrade only through an explicit review process rather than automatically accepting the latest release.

6. Advise users not to install the CLI as root or through sudo; installation and execution should use a minimally privileged account.

7. Consider distributing a reviewed lockfile or reproducible installation procedure and documenting the expected executable hash for supported platforms.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.