T03 · Remote Payload Retrieval and Execution
Error
- Location
guides/01-installation.md:78- Finding
Mutable Remote Homebrew Installer Is Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
Httpie
Security checks for vulnerabilities and agentic risk
Overview
This HTTPie skill is a coherent command-line API helper, but it asks agents to perform network requests, installations, credential use, and persistent session handling with several under-scoped safety controls.
Install only if you are comfortable reviewing commands before execution. Prefer user-scoped or pinned installations, avoid curl-to-shell and mutable binary downloads, do not put real secrets directly in commands, keep TLS verification enabled except in isolated testing, and treat HTTPie session files as sensitive credentials.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Error
- Location
guides/01-installation.md:172- Finding
Unpinned Executable Binaries Are Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
guides/01-installation.md:91- Finding
Unpinned Python Packages and Optional Plugins Expand the Supply-Chain Attack Surface
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (133)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The binary installation method downloads a remote file with curl and writes it directly into /usr/local/bin/http, then marks it executable, with no integrity verification, overwrite warning, or privilege/scope warning. In an agent-driven workflow this creates a high-risk path for replacing executables or installing unverified code into a trusted system location.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The configuration example recommends setting --verify=no as a default option, which disables TLS certificate validation for all future requests. This normalizes insecure transport and enables man-in-the-middle interception or spoofing of API endpoints, including theft of credentials and session data.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The curl-to-HTTPie mapping includes curl -k to http --verify=no without a strong warning, normalizing a dangerous way to bypass TLS certificate validation. In documentation, especially configuration-rich CLI guidance, this can lead users to disable HTTPS protections and become vulnerable to man-in-the-middle attacks.
- Content
md | `curl -H "Key: Val"` | `http "Key: Val"` | 请求头 | | `curl -d '{"k":"v"}'` | `http k=v` | JSON 请求体 | | `curl -u user:pass` | `http -a user:pass` | Basic 认证 | | `curl -k` | `http --verify=no` | 跳过 SSL 验证 | | `curl -L` | `http --follow` | 跟随重定向 | | `curl -o file` | `http -d -o file` | 保存到文件 | | `curl -v` | `http -v` | 详细输出 |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
bash # Ubuntu/Debian sudo apt update && sudo apt install ca-certificates sudo update-ca-certificates # macOS
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The
rm ~/.config/httpie/sessions/api.example.com/my-session.jsonexample permanently deletes session state and may remove saved cookies, headers, or authentication material without recovery. In documentation, destructive commands are risky when presented without a clear warning, backup step, or confirmation-safe alternative.- Content
cat ~/.config/httpie/sessions/*/my-session.json
技巧 5: 重置 Session
rm ~/.config/httpie/sessions/api.example.com/my-session.json
text ### 参考资源
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes example commands for POST, PUT, PATCH, and DELETE requests and also shows redirecting downloaded content to a local file, but it does not warn users that these examples can modify remote systems or persist untrusted data locally. In an agent context, this omission increases the chance that a user or automation executes destructive requests against real endpoints or writes unsafe content to disk without review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide explicitly tells an AI to directly execute installation and verification commands, including package installation and a live network request, without requiring user confirmation or warning about system changes and external connectivity. In an agent context, this can cause unintended software installation, environment modification, and outbound traffic on the user's machine.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian:
bash sudo apt update sudo apt install httpie http --version
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The uninstall section provides destructive removal commands without warning that software will be removed and workflows depending on HTTPie may break. In an autonomous agent setting, these commands could be run without the user's informed consent, causing avoidable disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide includes examples that embed secrets directly in commands (API keys, bearer tokens, and username:password) and later demonstrates file downloads, but it does not explicitly warn users that shell history, logs, screenshots, or verbose output may expose credentials, and that downloads write files to the local filesystem. In an AI/agent context, the earlier 'AI 可以直接执行以下命令并返回响应' language increases risk because an agent may execute these examples against real endpoints with substituted secrets or create local files without the user fully appreciating the side effects.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
This example shows sending a custom API key header to an external endpoint. In isolation the endpoint is illustrative, but the pattern normalizes putting secrets directly on the command line, which can leak via shell history, process listings in some environments, transcripts, or copied output; in an agent setting, it may also encourage automatic exfiltration of credentials to remote services.
- Content
bash # 添加自定义请求头（使用 : 语法） http https://api.example.com/users "X-API-Key: abc123" "Accept: application/json" # 发送带认证头的 POST 请求 http POST https://api.example.com/data \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This command includes a bearer token in an Authorization header for a remote POST request. Even though the token is truncated, the example teaches a pattern that can expose live tokens in command history, logs, AI transcripts, or verbose output, and it sends data externally to an arbitrary endpoint.
- Content
md http https://api.example.com/users "X-API-Key: abc123" "Accept: application/json" # 发送带认证头的 POST 请求 http POST https://api.example.com/data \ "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9..." \ "Content-Type: application/json" \ name="测试"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The Basic auth example embeds a literal username and password in a command sent to an external service. This is a well-known unsafe pattern because credentials can be exposed through shell history, copied terminal output, AI execution logs, and documentation reuse with real values substituted by users.
- Content
bash # -a 或 --auth 指定用户名:密码 http -a admin:secret123 https://api.example.com/protected # 只指定用户名（会提示输入密码） http -a admin https://api.example.com/protected
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This example places a bearer token directly in the command while contacting an external API. Such tokens are sensitive and can be leaked via shell history, logs, screenshots, terminal recording, or agent transcripts; the surrounding guide does not warn about these exposures.
- Content
bash # 直接在请求头中传入 Token http https://api.example.com/me "Authorization: Bearer my-access-token"Digest 认证
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This Digest auth example includes inline credentials for an external request. Although Digest avoids sending a plaintext password over the network, putting credentials in the shell command still risks local disclosure through history, logs, and agent observation.
- Content
Digest 认证
bash http --auth-type=digest -a user:pass https://api.example.com/digest
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This example shows a bearer token used against a real external service endpoint (GitHub API). Even with a placeholder token, it encourages sending sensitive credentials to a remote service and may be copied verbatim with real tokens, exposing them in shell history, notebooks, CI logs, or agent traces.
- Content
bash # 查询当前用户信息（Bearer Token） http https://api.github.com/user "Authorization: Bearer ghp_xxxxx"示例 4: 下载文件
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The session guidance explicitly stores cookies and authentication state on disk and even encourages inspecting the session file, but it does not warn that these files may contain bearer-equivalent credentials. In a CLI skill used for API testing, local credential persistence is expected functionality, yet omission of handling guidance can lead to credential theft from shared machines, backups, or permissive file permissions.
- Content