CleiMesh Setup

• Outcome: Pass
• Latest audit: Oct 28, 2026 · 5:09 AM UTC
• Version: 1.0.1

Overview

The skill describes a clearly scoped, user-controlled security setup, with an external installer that needs separate verification.

Review and verify the installer before running it, inspect the setup dry run, and grant only narrow folders. Setup creates a persistent service and disables native agent tools. The publisher describes CleiMesh as [alpha software](https://github.com/NVIDIA/OpenShell/discussions/4811); test with noncritical data first. This review does not verify the downloaded binary’s security guarantees.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping the downloaded installer into sh turns remote release content directly into executable commands without a verification or review step. This is the same supply-chain exposure identified by SC2, not a separate exploit, and the skill's security-focused purpose makes compromise particularly consequential.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Give the user this command to run themselves (it installs one binary, cleimesh):

sh

curl -fsSL https://github.com/cleitonaugusto/cleimesh/releases/latest/download/install.sh | sh

Check: cleimesh --version.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

5. Day to day

• Renew the tokens before they expire: the user runs the same setup line again. The taint state stays on the node.
• A write refused because of taint (received untrusted content ... clearing it takes a human): stop and tell the user which content tainted you and what you were about to write. Only they decide. To clear it, they run, with the node stopped:

  sh

  sudo systemctl stop cleimesh; cd /
  

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

• Narrow the token to what was actually used, after some days of work:

  sh

  # the token is 0600 and yours: pipe it in (cleimesh 0.1.5 or later)
  (cd / && sudo -u cleimesh -H cleimesh audit suggest --token -) < ~/.config/cleimesh/<agent>/write.json
  

  It proposes the narrowest grants and prints the token derive that applies them; nothing changes until someone runs it.
• Prove what happened: (cd / && sudo -u cleimesh -H cleimesh audit verify) checks the whole receipt log against the node's key.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

(cd / && sudo -u cleimesh -H cleimesh audit suggest --token -) < ~/.config/cleimesh//write.json

text

It proposes the narrowest grants and prints the `token derive` that applies them; nothing changes until someone runs it.
- **Prove what happened**: `(cd / && sudo -u cleimesh -H cleimesh audit verify)` checks the whole receipt log against the node's key.

## What CleiMesh does not do

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

• Renew the tokens before they expire: the user runs the same setup line again. The taint state stays on the node.
• A write refused because of taint (received untrusted content ... clearing it takes a human): stop and tell the user which content tainted you and what you were about to write. Only they decide. To clear it, they run, with the node stopped:

  sh

  sudo systemctl stop cleimesh; cd /
  sudo -u cleimesh cleimesh taint list
  sudo -u cleimesh cleimesh taint clear <HOLDER> --reason "why it is safe"
  sudo systemctl start cleimesh
  

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

• Narrow the token to what was actually used, after some days of work:

  sh

  # the token is 0600 and yours: pipe it in (cleimesh 0.1.5 or later)
  (cd / && sudo -u cleimesh -H cleimesh audit suggest --token -) < ~/.config/cleimesh/<agent>/write.json
  

  It proposes the narrowest grants and prints the token derive that applies them; nothing changes until someone runs it.
• Prove what happened: (cd / && sudo -u cleimesh -H cleimesh audit verify) checks the whole receipt log against the node's key.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

• A write refused because of taint (received untrusted content ... clearing it takes a human): stop and tell the user which content tainted you and what you were about to write. Only they decide. To clear it, they run, with the node stopped:

  sh

  sudo systemctl stop cleimesh; cd /
  sudo -u cleimesh cleimesh taint list
  sudo -u cleimesh cleimesh taint clear <HOLDER> --reason "why it is safe"
  sudo systemctl start cleimesh
  

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

sh

  sudo systemctl stop cleimesh; cd /
  sudo -u cleimesh cleimesh taint list
  sudo -u cleimesh cleimesh taint clear <HOLDER> --reason "why it is safe"
  sudo systemctl start cleimesh

The clearing is itself recorded as a receipt.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

sudo systemctl stop cleimesh; cd / sudo -u cleimesh cleimesh taint list sudo -u cleimesh cleimesh taint clear --reason "why it is safe" sudo systemctl start cleimesh

text

The clearing is itself recorded as a receipt.
- **A path refused** (not granted): tell the user which folder you needed and why. Widening means running `setup` again with another flag.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

(cd / && sudo -u cleimesh -H cleimesh audit suggest --token -) < ~/.config/cleimesh//write.json

text

It proposes the narrowest grants and prints the `token derive` that applies them; nothing changes until someone runs it.
- **Prove what happened**: `(cd / && sudo -u cleimesh -H cleimesh audit verify)` checks the whole receipt log against the node's key.

## What CleiMesh does not do

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The installation command immediately executes a remotely fetched script from a mutable latest-release URL without pinning or independent integrity verification. A compromised publisher account or release could execute arbitrary commands with the invoking user's access; requiring the human to run it does not remove that supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Give the user this command to run themselves (it installs one binary, cleimesh):

sh

curl -fsSL https://github.com/cleitonaugusto/cleimesh/releases/latest/download/install.sh | sh

Check: cleimesh --version.