Security audit

Bitnet

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent BitNet setup guide, but it includes agent-runnable system installation steps that execute remote scripts and handle a Hugging Face token without enough safety guidance.

Review commands before allowing an agent to run this skill. Prefer manually installing Homebrew/LLVM from official instructions, avoid piping remote scripts straight into a shell, use isolated conda environments, expect large model downloads, and use scoped Hugging Face tokens with care.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to clone a repository, download models from Hugging Face, create environments, install dependencies, and run setup scripts, but it does not warn about network access, large bandwidth/disk consumption, or local system changes. This can cause unexpected downloads, package installation, and execution of unreviewed setup code, which is risky in an agent context even if the underlying project is legitimate.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The macOS instructions pipe a remotely fetched script from GitHub directly into `/bin/bash`, which executes unreviewed code with no integrity verification, pinning, or warning about trust implications. In an AI-executable installation guide, this is especially risky because users or automation may run it verbatim, enabling supply-chain compromise or unintended system modification if the upstream script is malicious or tampered with.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The Linux instructions execute a remote shell script from `apt.llvm.org` via `bash -c "$(wget -O - ...)"` without any verification or warning. This creates a classic remote code execution and supply-chain risk, since any compromise of the host, network path, or script contents would run immediately on the user's machine.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The troubleshooting guide instructs users to run `sudo apt-get remove cmake` before reinstalling CMake, but provides no warning that package removal can affect dependent tooling or break system workflows. While not overtly malicious, this is unsafe operational guidance because users may remove a distro-managed package unnecessarily when a non-destructive upgrade path or side-by-side install would suffice.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The file tells users to execute a remotely fetched script directly with `bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)"`, which is a classic supply-chain risk. If the remote server, network path, or script contents are compromised, arbitrary code will run immediately on the user's machine without inspection or integrity verification.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide asks users to authenticate with HuggingFace and export an access token in an environment variable without any warning about credential exposure, shell history, process inspection, or accidental leakage into logs and shared environments. This can lead to token compromise and unauthorized access to model repositories or account-scoped resources.

Static analysis

No suspicious patterns detected.