PhiProto CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.3

Overview

This skill has a legitimate file-conversion purpose, but it installs and runs an unverified downloaded binary despite describing it as bundled.

Review before installing. Only use this skill if you trust the phicli upstream release and are comfortable with an executable being downloaded into $HOME/.local/bin. Prefer a version that bundles a reviewed binary or verifies a pinned checksum/signature and asks before replacing any existing phicli command.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: getphi.sh:1

Finding

Unverified Remote Binary Download and Subsequent Execution

Content

View full analysis

Vulnerability Details

File Location: getphi.sh, lines 1-3
Vulnerability Type: Unverified retrieval of executable code from an external source
Risk Level: High

bash

#!/usr/bin/env bash
mkdir -p "$HOME/.local/bin"
wget -O "$HOME/.local/bin/phicli" "https://github.com/chengongpp/phiproto/releases/download/0.0.2/phicli"

Technical Analysis

The installation script downloads a precompiled executable directly from a third-party GitHub release into $HOME/.local/bin/phicli. It does not verify a cryptographic checksum, release signature, signer identity, or other integrity metadata before the binary is used.

Pinning the URL to release 0.0.2 limits ordinary version drift but does not establish artifact integrity. The effective executable could change if the upstream repository, release artifact, maintainer account, or distribution infrastructure were compromised. This allows code not present during the skill audit to become the effective runtime payload.

The target path may also contain an existing phicli command. The use of wget -O replaces its contents without warning, potentially causing future legitimate-looking phicli calls to execute the newly downloaded payload. SKILL.md directs users or agents to invoke phicli for decoding and encoding, completing the path from remote retrieval to execution.

Attack Path

1. An attacker compromises the upstream repository, release artifact, maintainer account, or another relevant distribution component.
2. The attacker replaces the 0.0.2 binary with a malicious executable while retaining the expected URL.
3. A user or agent runs getphi.sh.
4. The script downloads the artifact without validating its checksum or signature and writes it to $HOME/.local/bin/phicli.
5. The user or agent subsequently invokes phicli according to the documented decode or encode workflow.
6. The malicious binary executes with the permissions and environment of th ...[truncated 757 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish a trusted SHA-256 or stronger digest for the exact release artifact and hard-code the expected digest in the installer.
2. Download the artifact to a securely created temporary file and verify its digest before moving it into the destination directory.
3. Prefer signed releases and verify the signature against a pinned, independently distributed maintainer public key.
4. Use strict shell settings such as set -euo pipefail and explicitly handle download and verification failures.
5. Install atomically only after successful verification.
6. Refuse to overwrite an existing $HOME/.local/bin/phicli unless the user explicitly approves the replacement.
7. Pin not only the version but also the immutable expected artifact identity.
8. Where practical, build the utility from reviewed source using a reproducible build process rather than trusting an opaque precompiled binary.
9. Update SKILL.md to state that the binary is downloaded rather than bundled and to document the verification procedure and expected checksum.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as if it works with a bundled local binary, but the instructions actually require downloading an external executable from GitHub and staging it locally. That mismatch can mislead users and agents into trusting and executing unreviewed code from the network, creating a software supply-chain risk with potential arbitrary code execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands and directs use of an external executable, but it declares no explicit tool scope or permission boundaries. This increases the chance that an agent may run commands without clear restriction or review, especially when handling user-supplied paths and file outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill encourages writing decoded or encoded results to explicit output files but does not warn about overwriting existing files or writing to sensitive paths. In an agentic context, that can lead to unintended data loss or modification of local files when handling attacker-controlled filenames or user mistakes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script silently creates a user-local bin directory and writes an executable into it without warning, consent, or integrity checks. This can persist an unreviewed binary in the user's environment, making later accidental execution possible and increasing the impact of any upstream compromise or malicious replacement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill metadata says it uses a bundled phicli binary, but the installer actually downloads phicli from a remote release URL. This mismatch is security-relevant because it hides runtime code acquisition from reviewers and users, undermining trust and allowing the executed binary to differ from what was evaluated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script retrieves an executable directly from a remote GitHub release URL at install time, which creates a supply-chain risk and gives the skill undeclared network-fetch capability. Because the skill claims to use a bundled binary for file conversion, dynamically pulling code from the internet is unnecessary and increases the chance of executing a tampered, replaced, or unexpected binary.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest says to trigger on requests to "inspect, decode, encode, validate, or explain PhiProto content," which is fairly broad and lacks explicit constraints or negative examples. While PhiProto is somewhat domain-specific, the trigger scope does not clearly distinguish file-conversion tasks from general conceptual discussion, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The safety notes assert the tool runs local-only while also instructing users to download the binary from GitHub. This contradictory guidance can lower operator caution and mask the fact that the workflow depends on fetching and trusting remote code, which is a classic setup for supply-chain compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.