Alexa CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:13 AM UTC
• Version: 1.3.0

Overview

The skill is coherent, but it should be reviewed carefully because it can control real-world Alexa-linked devices, expose private Alexa activity, and installs an unpinned third-party CLI.

Install only if you trust the third-party alexacli project and are comfortable granting it access to your Alexa account and connected devices. Use explicit device names, confirm any lock, thermostat, broadcast, or other physical action before running it, and avoid retrieving or echoing history, calendar, or conversation data unless the account owner clearly requested it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:14

Finding

Unpinned and Unverified Third-Party CLI Installation Sources

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 14–27
Vulnerability Type: Supply-chain risk from mutable third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet

yaml

"install":
  [
    {
      "id": "brew",
      "kind": "brew",
      "formula": "buddyh/tap/alexacli",
      "bins": ["alexacli"],
      "label": "Install alexacli (brew)",
    },
    {
      "id": "go",
      "kind": "go",
      "module": "github.com/buddyh/alexa-cli/cmd/alexa@latest",
      "bins": ["alexacli"],
      "label": "Install alexa-cli (go)",
    },
  ],

Technical Analysis

Both installation methods resolve remotely maintained third-party content without an immutable version, commit, checksum, or signature verification. The Go installation explicitly uses @latest, so the installed implementation can change after this skill has been reviewed. The custom Homebrew tap is similarly specified without a fixed formula revision.

This does not prove that the current upstream project is malicious. It creates a supply-chain exposure in which compromise of the repository, release process, package source, custom tap, or maintainer account could cause installation of an attacker-controlled alexacli binary.

Attack Path

1. An attacker compromises the upstream repository, custom Homebrew tap, maintainer credentials, or release pipeline.
2. The attacker publishes a malicious release or modifies the package metadata resolved by the unpinned reference.
3. A user or agent installs the dependency using the documented Homebrew formula or Go @latest module.
4. The malicious binary executes with the privileges of the installing or invoking user.
5. When used as documented, the binary can access locally stored Alexa configuration and authentication material.
6. The binary may exfiltrate credentials or abuse the authenticated Alexa session to query private information and control linke ...[truncated 644 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, fixed semantic version or immutable commit.
2. Pin the Homebrew installation to a reviewed release or formula revision where the installation framework supports it.
3. Verify release signatures and cryptographic checksums before installation.
4. Prefer an official, trusted distribution channel over a custom third-party tap where possible.
5. Record the expected dependency version and integrity digest in the skill metadata or installation documentation.
6. Establish a controlled update process that reviews upstream changes before changing the pinned version.
7. Run the CLI with least privilege and restrict access to the Alexa configuration and token files.
8. Revoke Alexa credentials and investigate linked-device activity if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes privacy-sensitive capabilities such as history, conversations, fragments, and calendar/query retrieval without prominently warning that these commands may reveal household activity, spoken requests, schedules, or other personal data. In an agent setting, users may not realize that invoking these features can surface sensitive account-linked information and potentially disclose it in logs, chat output, or to an unintended requester.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents commands that can control physical devices and home state, including lights, thermostats, locks, timers, and announcements, but it does not include safety gating or explicit warnings about real-world side effects. In an autonomous or semi-autonomous agent context, natural-language command forwarding to Alexa can trigger unintended physical actions, including securing or altering access to property, making this more dangerous than a typical informational CLI.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.