SkillsVideo CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 0.0.7

Overview

The skill is coherent for AI image and video generation, but it tells agents to install a third-party CLI by piping an online installer directly into bash without verification or clear user approval.

Review this carefully before installing. The skill appears designed for its advertised skills.video workflow, but installation should be treated like running third-party code on your machine. Prefer a pinned, verifiable installer or inspect and approve the installer manually before execution, and be aware that login/session state and local CLI configuration may persist.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:33

Finding

Unverified Remote Installer Is Downloaded and Executed Through Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:33
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

Complete Code Snippet:

bash

curl -fsSL https://skills.video/cli/install.sh | bash

Technical Analysis

The installation instructions pipe a remotely retrieved shell script directly into Bash. The script is not included in the audited project, so its effective behavior cannot be reviewed from the repository and may change at any time without changing this Skill.

The command provides no version pinning, cryptographic signature or checksum verification, local inspection step, or explicit user approval before execution. HTTPS protects the connection in ordinary circumstances but does not establish that every future version of the remote installer is trustworthy. Compromise of the remote website, hosting account, CDN, DNS path, TLS infrastructure, or release process could turn the installer into an arbitrary payload delivery mechanism.

Installing the CLI is relevant to the Skill's declared image and video generation functionality. However, immediate execution of mutable network content is not the least-privileged installation method. A pinned and independently verified package or release artifact would reduce the required trust and execution scope.

Attack Path

1. The Skill is loaded for an image or video generation request.
2. The skillsvideo executable is not present on the user's system.
3. Following the mandatory installation workflow, the agent runs the documented curl | bash command.
4. An attacker who controls or compromises the remote installer delivery path modifies install.sh.
5. curl streams the attacker-controlled content directly to Bash without integrity verification or prior inspection.
6. Bash executes the payload with the permissions and environment of the agent process.

Impact Assessment

A malicious installer could execute arb ...[truncated 730 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the direct curl | bash pipeline with a pinned, auditable package or versioned release artifact.
2. Publish cryptographic checksums and preferably signed release metadata through an independently verifiable channel.
3. Download the installer or artifact to a local file first, then verify its signature or checksum before execution.
4. Allow the user or agent to inspect the downloaded script and require explicit user approval before running it.
5. Avoid requesting administrator privileges unless a specific installation step strictly requires them; prefer a user-scoped installation directory.
6. Pin the expected installer or CLI version rather than silently executing the latest mutable server response.
7. Document the files, configuration, credentials, and network endpoints used by the installer and provide removal instructions.
8. If a shell installer remains necessary, fail closed when integrity verification is unavailable or unsuccessful.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The installation step performs a system-modifying action without any warning, consent checkpoint, or explanation of risk. In an autonomous agent workflow this can lead to silent installation of third-party software and execution of arbitrary installer logic on the user's machine.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching a script from an external site and piping it straight into bash is a classic arbitrary code execution pattern. The safety of the host is entirely delegated to the transport, domain, and remote server state at runtime; if any are compromised, the agent will execute attacker-controlled code immediately.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

If skillsvideo is not installed on the user's machine, install it before doing anything else:

bash

curl -fsSL https://skills.video/cli/install.sh | bash

After installation, continue with skillsvideo -h or the target subcommand help.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash construct converts downloaded data directly into shell commands, removing any opportunity for validation or inspection before execution. In a skill file, this is especially dangerous because it can be triggered as part of an agentic workflow, turning documentation into an execution path for arbitrary commands.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

If skillsvideo is not installed on the user's machine, install it before doing anything else:

bash

curl -fsSL https://skills.video/cli/install.sh | bash

After installation, continue with skillsvideo -h or the target subcommand help.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match many ordinary requests involving creating or making content, which can cause the agent to invoke this skill in situations where the user did not specifically request this tool. Because the skill then recommends installation and use of an external CLI, over-broad activation increases the chance of unnecessary external actions and unintended system changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to install software by executing a remote script directly from the network with no integrity verification, pinning, or user confirmation. In an agent context this expands the skill from media generation into arbitrary code execution on the host, so compromise of the remote endpoint or installer immediately becomes system compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.