ClawHub
Back to skill

Security audit

present

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for creating narrated Bisque presentations, but it directs users to run unverified remote installer scripts and sends some machine-identifying data during login without clear disclosure.

Review the installer path before installing. Prefer downloading a versioned Bisque Voice installer, verifying its checksum or signature, and running it only after inspection rather than using the printed curl | sh or irm | iex commands. Be aware that login stores an API key locally, publishes selected presentation files and assets to Bisque, and sends basic device-identifying information to the configured Bisque API endpoint.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:34
Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content
View full analysis
Remediation
View remediation

other

Warning
Location
scripts/present.mjs:1529
Finding

Login Transmits Undisclosed Host and Hardware Telemetry

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
`scripts/present.mjs` in this skill directory does the mechanical half — narration

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
`scripts/present.mjs` in this skill directory does the mechanical half — narration

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a curl | sh / irm | iex installation pattern, which executes remote code directly from the network without integrity verification or review. If the download server, DNS, TLS trust chain, or hosting path is compromised, the agent could run attacker-controlled code on the local machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

download it (~13 MB, ~30 MB installed) and what it is, then:

sh
curl -fsSL https://download.bisque.today/bisque-voice/install.sh | sh   # macOS, Linux
powershell

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The code instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | sh / PowerShell equivalent). This is dangerous because compromise of the download host, TLS interception, or accidental script changes would yield immediate arbitrary code execution on the user's machine.

Content

Scanner excerpt · scripts/present.mjs (reported line 464)May include surrounding context.

js
"Install it, then re-run:\n" +
      (process.platform === "win32"
        ? "  irm https://download.bisque.today/bisque-voice/install.ps1 | iex"
        : "  curl -fsSL https://download.bisque.today/bisque-voice/install.sh | sh"),
  );
}

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

This path again recommends updating via direct remote-script execution. Even though it is only printed as guidance, embedding unsafe operational instructions in a skill materially increases the chance that an agent or user will perform arbitrary code execution from a mutable external source.

Content

Scanner excerpt · scripts/present.mjs (reported line 610)May include surrounding context.

js
say(
      "note: this bisque-voice has no aligner support — narration sync may " +
        "drift on Studio engines. Update it: " +
        "curl -fsSL https://download.bisque.today/bisque-voice/install.sh | sh",
    );
    return;
  }

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The doctor/install output repeats unsafe installation advice using direct execution of downloaded scripts. Repetition across multiple code paths increases exposure by normalizing a risky practice and making it more likely to be followed during troubleshooting.

Content

Scanner excerpt · scripts/present.mjs (reported line 1378)May include surrounding context.

js
say(
      process.platform === "win32"
        ? "  install: irm https://download.bisque.today/bisque-voice/install.ps1 | iex"
        : "  install: curl -fsSL https://download.bisque.today/bisque-voice/install.sh | sh",
    );
  }
  const auth = resolveAuth({

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The pronunciation-report failure path also directs users to run a fetched script immediately, preserving the same arbitrary-code-execution risk. Error paths are especially sensitive because users are more likely to follow remediation commands without scrutiny.

Content

Scanner excerpt · scripts/present.mjs (reported line 1686)May include surrounding context.

js
"update it first:\n" +
            (process.platform === "win32"
              ? "  irm https://download.bisque.today/bisque-voice/install.ps1 | iex"
              : "  curl -fsSL https://download.bisque.today/bisque-voice/install.sh | sh"),
        );
      }
      fail(

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs the agent to use shell, network, and environment-sensitive operations, but declares no explicit tool scope or permission boundaries. That creates an over-privileged execution model where the agent may perform installs, credential-dependent actions, and publishing without a machine-readable allowlist, increasing the chance of unsafe or unintended actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md
the account's reference recording (made in the browser during the welcome
flow) and runs `bisque-voice clone` locally, once. If the account has no
recording, it stops and says to record one at bisque.cloud/welcome — relay
that; never ask the user to produce a recording in the terminal.

## 5. Edits are cheap — never re-narrate everything

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill can invoke local subprocesses and trigger installation of large voice engines/aligners via a local binary, which expands its authority well beyond simple presentation generation. In an agent setting, this increases risk because a content-authoring request can lead to system modification and execution of downloaded components without an explicit, tightly scoped user approval step.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes a skill for making a presentation and publishing it to a watch URL. In addition to that core flow, this file implements separate account-management and platform-discovery commands such as browser login, username claiming, and fetching soft-launched authoring specs, which expand the skill beyond simply authoring/publishing a deck.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/present.mjs:469

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/present.mjs:43

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/present.mjs:899