readme-writer-skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:19 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent README-writing helper, but it teaches agents to recommend an unsafe remote installer pattern that can lead users to run unverified code.

Review generated installation sections before publishing. Replace any curl-pipe-sh installer examples with package-manager commands, versioned release downloads, or explicit checksum/signature verification steps.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:131

Finding

Unsafe Remote Script Execution Recommended as a Universal Installation Method

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 131
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://get.example.com | sh  # Universal: curl-pipe-sh

Technical Analysis

The Skill recommends piping an HTTP response directly into sh. Although example.com is a reserved placeholder domain, the instruction presents curl | sh as a universal installation pattern that may be reproduced with a real project-controlled URL in generated READMEs.

This pattern executes mutable remote content without giving the user an opportunity to inspect it. It provides no version pinning, checksum verification, cryptographic signature validation, or trust-boundary separation between downloading and execution. The code reviewed during the Skill audit can therefore differ from the script eventually executed by a downstream user.

Remote shell execution is not necessary for the Skill's declared README-writing functionality. Recommending it exceeds the minimum capability required and creates an avoidable downstream supply-chain risk.

Attack Path

1. The Skill uses the installation guidance to generate or improve a project's README.
2. The placeholder URL is replaced with a real installer endpoint controlled by the project or another party.
3. A downstream user copies and runs the generated command.
4. curl retrieves the endpoint's current response.
5. The response is passed directly to sh without integrity or authenticity verification.
6. An attacker who controls or compromises the endpoint, hosting account, release pipeline, or relevant network infrastructure serves a malicious script.
7. The malicious response executes with the privileges of the user running the installation command.

Impact Assessment

Successful exploitation provides arbitrary command execution with the invoking user's privileges. The reachable scope can include:

• Reading or modifying files acce ...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh example and do not characterize this installation method as universal.

2. Prefer trusted package managers with package signing and explicit version selection, such as apt, Homebrew, PyPI, npm, or crates.io, as appropriate for the project.

3. When distributing standalone binaries, link to immutable, versioned release artifacts and publish cryptographic checksums and signatures through an independent trusted channel.

4. If an installer script is unavoidable, separate retrieval from execution:

   bash

   curl -fL --proto '=https' --tlsv1.2 \
     -o install.sh \
     https://downloads.example.org/releases/v1.2.3/install.sh
   
   printf '%s  %s\n' 'EXPECTED_SHA256' 'install.sh' | sha256sum --check -
   less install.sh
   sh install.sh
   

5. Pin the script to a specific release rather than a mutable branch or generic installer endpoint.

6. Document the script's intended filesystem changes and required privileges. It should refuse to run with elevated privileges unless those privileges are strictly necessary.

7. Update the Skill's guidance to warn against directly executing unverified network responses and to require integrity and authenticity checks in generated installation instructions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill explicitly recommends a curl ... | sh installation pattern, which encourages execution of remote code without verification. In a README-writing skill, this is especially risky because the model may reproduce this pattern into user-facing documentation, normalizing an unsafe supply-chain practice that could lead to arbitrary code execution if the fetched script is compromised or replaced.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

pip install fastapi # Python: pip npm install express # Node.js: npm brew install ripgrep # macOS: Homebrew curl -fsSL https://get.example.com | sh # Universal: curl-pipe-sh

text

Then provide alternatives:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says to use the skill whenever the user wants to write, improve, or review a README for any open source repository, and includes broad triggers like "help me with my README," "project documentation," and "make my README better." These phrases are common and lack clear exclusion conditions or scope boundaries, which could cause unintended invocation for general documentation conversations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.