T03 · Remote Payload Retrieval and Execution
Error
- Location
guides/01-installation.md:70- Finding
Unverified Remote Installer Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Langextract
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent LangExtract guidance, but it includes unsafe installer instructions and under-discloses sensitive document/API-key handling.
Install only after reviewing the commands. Do not run the curl-to-sh Ollama installer blindly; use an official verified installer or inspect and verify it first. Use a virtual environment, avoid unpinned upgrades when reproducibility matters, do not print full API keys, and do not send medical, legal, confidential, or regulated documents to hosted model providers unless you have approval and understand provider retention and privacy terms. Treat saved JSONL/HTML outputs as potentially sensitive files.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:34- Finding
Unpinned Third-Party Package Installation and Upgrade
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
troubleshooting.md:34- Finding
API Key Printed in Plaintext During Troubleshooting
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
获取 API Key：https://aistudio.google.com/app/apikey
export GOOGLE_API_KEY="your-api-key-here"
或写入 .env 文件（配合 python-dotenv 使用）
echo 'GOOGLE_API_KEY=your-api-key-here' >> .env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
获取 API Key：https://aistudio.google.com/app/apikey
export GOOGLE_API_KEY="your-api-key-here"
或写入 .env 文件（配合 python-dotenv 使用）
echo 'GOOGLE_API_KEY=your-api-key-here' >> .env
text
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The command fetches a script from the internet and executes it immediately, giving the remote content full code-execution capability on the host. In an installation guide aimed at users who may copy-paste commands, this materially increases the chance of unsafe execution without review or authenticity checks.
- Content
bash # 先安装 Ollama curl -fsSL https://ollama.com/install.sh | sh # 拉取模型（如 Llama3） ollama pull llama3.2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The use of '| sh' is the dangerous element that turns a network fetch into immediate shell execution, eliminating any review step and enabling command chaining abuse. If the fetched content is altered or intercepted, the user executes arbitrary shell commands with their current privileges.
- Content
bash # 先安装 Ollama curl -fsSL https://ollama.com/install.sh | sh # 拉取模型（如 Llama3） ollama pull llama3.2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The guide tells users to execute a remotely fetched shell script directly with
curl ... | sh, which grants immediate code execution to content retrieved over the network without prior inspection or integrity verification. If the remote site, CDN, DNS, TLS trust chain, or distribution path is compromised, users can be induced to run arbitrary code on their machine.- Content
bash # 先安装并启动 Ollama curl -fsSL https://ollama.com/install.sh | sh ollama serve # 下载模型（选择一个）
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| shpipeline is a classic chaining-abuse pattern because it converts untrusted network data directly into shell commands, removing any review boundary. In developer documentation, this is especially dangerous because readers often copy-paste commands verbatim, turning a documentation snippet into a practical remote code execution vector.- Content
bash # 先安装并启动 Ollama curl -fsSL https://ollama.com/install.sh | sh ollama serve # 下载模型（选择一个）
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs the AI to install the package, configure API keys, and process text or document URLs with Gemini/OpenAI/Ollama, but it does not clearly warn that input content may be transmitted over the network to external model providers or fetched from remote URLs. In a data-extraction skill aimed at clinical, legal, and enterprise documents, this omission can cause users to unintentionally expose sensitive or regulated data to third parties.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide instructs users to execute a remote shell script directly via a pipe without any integrity verification, pinning, or warning. This creates a classic supply-chain execution risk: if the remote server, CDN, DNS, TLS termination, or install script is compromised, users may immediately run attacker-controlled code on their systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The quickstart includes processing of clinical notes and then saving extracted results locally, but it provides no warning that the example data may contain protected health information and may be transmitted to a third-party model provider. In a getting-started guide, omission of privacy, consent, retention, and de-identification guidance can lead users to handle real medical data unsafely by default.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide encourages passing a URL directly for extraction without warning that the library will fetch remote content and may then send that content to the configured LLM. This can cause users to unknowingly process copyrighted, confidential, or untrusted remote data and expands risk through server-side requests, unexpected data egress, and handling of malicious or sensitive documents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The batch-save example persists extracted results to JSONL and generates an HTML visualization without warning that those outputs may contain sensitive source text, extracted personal data, or other confidential information. In a data-extraction library, users may reasonably apply this workflow to research papers, contracts, or medical text, so silent persistence increases the chance of unintended local exposure, sharing, or downstream ingestion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The OpenAI example instructs users to send document text to a remote API model but does not disclose that the supplied content leaves the local environment and is processed by a third-party provider. For a tool explicitly used on long documents, reports, contracts, and radiology text, this omission can lead users to transmit sensitive or regulated data without informed consent or proper controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire troubleshooting guide is written in Chinese, and there is no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. Per the policy, imposing a language/locale without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This file forces a specific language for user-facing documentation, and there is no indication that the locale constraint is intentional, optional, or region-specific. Under the policy, language-specific content should offer user choice or clearly justify the restriction.
- Content
Static analysis
No suspicious patterns detected.