Security audit

Signal

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with Signal integration, but its embedded install steps ask users to run unverified third-party downloads and make persistent shell changes.

Review the install commands before running them. Prefer an OS package manager or a pinned signal-cli release with checksum or signature verification, avoid automatic ~/.bashrc edits unless you want persistent PATH changes, and use a separate Signal bot number with allowlists for messaging control.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:191
Finding: Unverified Third-Party Executable Download and Execution
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 191–215 and 232–238
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

The installation instructions dynamically identify the latest signal-cli release, download executable archives from GitHub, extract them into a user-controlled executable path, and run the installed program without verifying a cryptographic signature or expected checksum.

Vulnerable code:

bash
VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//') curl -L -O "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}-Linux-native.tar.gz" mkdir -p ~/.local/bin tar -C ~/.local/bin -xzf "signal-cli-${VERSION}-Linux-native.tar.gz" signal-cli chmod +x ~/.local/bin/signal-cli echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc # or ~/.zshrc source ~/.bashrc signal-cli --version

bash
VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//') curl -L -O "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}.tar.gz" mkdir -p ~/.local/bin/signal-cli tar -C ~/.local/bin/signal-cli -xzf "signal-cli-${VERSION}.tar.gz" cat > ~/.local/bin/signal-cli <<'EOF' #!/usr/bin/env bash exec java -jar "$HOME/.local/bin/signal-cli/lib/signal-cli-$VERSION.jar" "$@" EOF chmod +x ~/.local/bin/signal-cli echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc source ~/.bashrc signal-cli --version

bash
VERSION=$(signal-cli --version | head -1 | sed 's/^signal-cli //' | cut -d+ -f1) curl -Ls -o /tmp/signal-cli.tar.gz "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}.tar.gz" mkdir -p ~/.local/share/man/man1 ~/.local/share/man/man5 tar -C ~/.local/share/man -xzf ...[truncated 3451 chars]
Remediation: View remediation
Remediation Suggestions

Pin VERSION to a specifically reviewed signal-cli release instead of resolving the mutable latest redirect.

Provide a trusted SHA-256 digest for each supported archive and verify it before extraction:
bash
echo 'EXPECTED_SHA256 signal-cli-VERSION-Linux-native.tar.gz' | sha256sum --check -

Prefer cryptographic release-signature verification where upstream signatures and a securely distributed signing key are available.

Use fail-safe download options so HTTP failures do not produce files that are subsequently processed:
bash
curl --fail --show-error --location --output "$archive" "$url"

Download into a private temporary directory created with mktemp -d, set a restrictive umask, and remove the directory after installation.

Verify the archive before extracting or changing permissions. Inspect the archive member list and continue extracting only explicitly expected paths.

Avoid automatically sourcing shell startup files. Instruct users to start a new shell or update PATH manually, and make any profile modification idempotent.

Correct the JVM installation layout so the installation directory and launcher file have distinct paths. Embed the validated version into the launcher at installation time or use a stable launcher target.

Prefer a trusted operating-system package manager when an appropriately maintained package is available, while still documenting the package provenance and update policy.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (10)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
PATH):

bash
VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//') curl -L -O "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}-Linux-native.tar.gz" mkdir -p ~/.local/bin tar -C ~/.local/bin -xzf "signal-cli-${VERSION}-Linux-native.tar.gz" signal-cli chmod +x ~/.local/bin/signal-cli echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc # or ~/.zshrc source ~/.bashrc signal-cli --version

Linux (JVM build, user-local)

bash
VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//') curl -L -O "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}.tar.gz" mkdir -p ~/.local/bin/signal-cli tar -C ~/.local/bin/signal-cli -xzf "signal-cli-${VERSION}.tar.gz" cat > ~/.local/bin/signal-cli <<'EOF' #!/usr/bin/env bash exec java -jar "$HOME/.local/bin/signal-cli/lib/si

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill goes beyond describing Signal messaging behavior and includes step-by-step software installation, network downloads, archive extraction, wrapper creation, and shell startup modification. Even if operationally useful, this expands the agent's implied authority and can normalize execution of system-changing actions from documentation, increasing the chance of unsafe or unintended host modification.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
Installing signal-cli

Linux (user-local, native build — recommended)

No sudo required. Install to ~/.local/bin (ensure it's in your PATH):

bash
VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//')

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: Appending to ~/.bashrc creates persistent environment changes that survive the current session. While not malicious by itself, persistence mechanisms are security-relevant because they alter future shell behavior and are unnecessary for a narrowly scoped messaging skill.
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
bash
VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//') curl -L -O "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}-Linux-native.tar.gz" mkdir -p ~/.local/bin tar -C ~/.local/bin -xzf "signal-cli-${VERSION}-Linux-native.tar.gz" signal-cli chmod +x ~/.local/bin/signal-cli echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc # or ~/.zshrc

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: This block creates a persistent local wrapper script in ~/.local/bin and installs extracted files under a user-controlled path. Persistently adding executable content is a security-sensitive action because it changes future command resolution and extends beyond ordinary message-channel usage.
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
bash
VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//') curl -L -O "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}.tar.gz" mkdir -p ~/.local/bin/signal-cli tar -C ~/.local/bin/signal-cli -xzf "signal-cli-${VERSION}.tar.gz" cat > ~/.local/bin/signal-cli <<'EOF' #!/usr/bin/env bash

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
VERSION=$(signal-cli --version | head -1 | sed 's/^signal-cli //' | cut -d+ -f1) curl -Ls -o /tmp/signal-cli.tar.gz "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}.tar.gz" # Install to your local manpath (no sudo needed) mkdir -p ~/.local/share/man/man1 ~/.local/share/man/man5 tar -C ~/.local/share/man -xzf /tmp/signal-cli.tar.gz --strip-components=2 signal-cli-${VERSION}/man/man1/signal-cli.1.gz signal-cli-${VERSION}/man/man5/signal-cli-jsonrpc.5.gz signal-cli-${VERSION}/man/man5/signal-cli-dbus.5.gz

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: Installing man pages under ~/.local/share/man and updating MANPATH introduces persistent user-environment changes, though lower risk than adding executables to PATH. It is still beyond the minimum scope needed for operating a Signal messaging integration and increases host modification surface.
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
md
curl -Ls -o /tmp/signal-cli.tar.gz "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}.tar.gz" # Install to your local manpath (no sudo needed) mkdir -p ~/.local/share/man/man1 ~/.local/share/man/man5 tar -C ~/.local/share/man -xzf /tmp/signal-cli.tar.gz --strip-components=2 signal-cli-${VERSION}/man/man1/signal-cli.1.gz signal-cli-${VERSION}/man/man5/signal-cli-jsonrpc.5.gz signal-cli-${VERSION}/man/man5/signal-cli-dbus.5.gz # Update MANPATH (add to your ~/.bashrc or ~/.zshrc for persistence)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: These install instructions perform external downloads, extract binaries, modify executable locations, and update shell initialization files without prominently warning that they change the local environment. That omission can lead an agent or user to treat the commands as low-risk setup when they have persistent system effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The alternative install path downloads an archive, extracts it, creates a local wrapper script, and modifies shell configuration, again without an explicit safety warning. Script creation and profile modification increase the chance of persistent unintended changes and make this variant more invasive than simple usage guidance.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill explicitly instructs reading local man pages into agent context for its own reference, which expands from messaging operations into local file access. This creates unnecessary authority to inspect local resources and could be generalized by an agent into broader host file reads not required for normal Signal messaging tasks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Remediation Suggestions

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Linux (JVM build, user-local)

Context-Inappropriate Capability

Sudo/Root Execution

Installing signal-cli

Linux (user-local, native build — recommended)

Session Persistence

Session Persistence

Sudo/Root Execution

Session Persistence

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Static analysis