ClawHub
Back to skill

Security audit

Grok Build

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for installing and using Grok Build, but its recommended install commands execute remotely downloaded scripts without verification.

Review the install path before using this skill. Prefer downloading a versioned installer or binary from the official release channel, verifying a checksum or signature when available, inspecting scripts before running them, and avoiding elevated privileges unless clearly required. Treat Grok Build itself as a powerful coding agent that can modify files, run commands, use network access, and authenticate through a browser.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:24
Finding

Remote Installation Scripts Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24-25
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

bash
curl -fsSL https://x.ai/cli/install.sh | bash
irm https://x.ai/cli/install.ps1 | iex

Technical Analysis

The installation instructions download mutable remote content and execute it immediately in a local shell. The Unix command pipes the HTTP response directly to Bash, while the PowerShell command passes the downloaded response to Invoke-Expression. Neither procedure pins a release, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the script before execution.

The URL is hosted on the stated first-party HTTPS domain, which reduces but does not eliminate risk. The effective installer is not present in this project and may change after the Skill has been reviewed. Compromise of the hosting infrastructure, DNS or TLS trust path, publication credentials, or installer delivery process could therefore turn the documented installation procedure into arbitrary code execution.

Installing the declared CLI is consistent with the Skill's purpose. However, executing streamed remote content is not required to provide that functionality and exceeds the minimum safe installation behavior. The script receives all permissions held by the invoking account; if the command is run with elevated privileges, the payload receives those elevated privileges as well.

Attack Path

  1. An attacker compromises the installer hosting or publication channel, or otherwise causes https://x.ai/cli/install.sh or its PowerShell equivalent to return attacker-controlled content.
  2. A user or automation system follows the instructions in SKILL.md.
  3. curl or Invoke-RestMethod retrieves the modified script.
  4. Bash or Invoke-Expression executes the response immediately, without integrity validation or prior inspection.
  5. The ...[truncated 789 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not pipe downloaded content directly into Bash or Invoke-Expression.
  2. Prefer a trusted package manager or a signed, versioned release binary from the official release channel.
  3. Pin the installer or artifact to a specific immutable release version rather than a mutable installation endpoint.
  4. Download the artifact to a local file before execution so it can be inspected:
    bash
    curl -fL -o install.sh https://example.invalid/path/to/versioned/install.sh
  5. Publish and verify a cryptographic signature using a separately distributed, pinned public key. If signatures are unavailable, verify a release-specific SHA-256 checksum obtained through an independently protected channel.
  6. Execute the verified installer explicitly and without elevated privileges unless a documented installation step strictly requires elevation.
  7. Document the files, directories, network endpoints, and permissions used by the installer so users can assess its effects.
  8. Apply equivalent controls to the PowerShell installation path; avoid Invoke-Expression and use a signed, downloaded script with an appropriate execution policy after verification.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching an external script with curl and executing it via bash is a classic arbitrary code execution pattern. In a developer tool skill, users are especially likely to copy-paste this command, making compromise of the distribution path or script contents immediately dangerous.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

预编译二进制（推荐）

bash
curl -fsSL https://x.ai/cli/install.sh | bash
irm https://x.ai/cli/install.ps1 | iex
grok --version

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The '| bash' chain removes any inspection point between download and execution, amplifying the danger of malicious or altered content. Because this skill concerns an AI coding agent with shell access, normalizing unsafe command chaining increases the chance that users adopt similarly unsafe operational patterns.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

预编译二进制（推荐）

bash
curl -fsSL https://x.ai/cli/install.sh | bash
irm https://x.ai/cli/install.ps1 | iex
grok --version

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises shell execution, file editing, web search, and headless/CI operation without any safety guidance about command effects, secret exposure, filesystem modification, or network access. In an agent skill context, these capabilities can cause real system or data impact if a user assumes the workflow is inherently safe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installation instructions directly pipe remotely fetched content into bash and PowerShell, which executes unreviewed code immediately. If the upstream server, transport, DNS, or hosting path is compromised, users can suffer arbitrary code execution on their machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language content of the skill file is presented in Chinese, but the document does not indicate that this locale is optional or region-specific. This can conflict with language/locale policy expectations when users are not given an explicit choice.

Content

No source excerpt is available for this finding.