Starlink

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:31 AM UTC
• Version: 1.0.1

Overview

The skill’s Starlink purpose is clear, but it installs mutable remote code and exposes disruptive device actions and precise location data without enough scoping or consent guidance.

Review this skill before installing. Use it only for explicit Starlink requests, avoid installing or running it with elevated privileges, prefer a pinned and reviewed starlink-cli revision, and require clear confirmation before stow, unstow, reboot, client listing, or GPS location commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:7

Finding

Unpinned Remote Git Repository Is Downloaded and Compiled

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7 and 15
Vulnerability Type: Unpinned remote payload retrieval and execution
Risk Level: Medium

Vulnerable code snippets:

yaml

metadata: {"clawdbot":{"emoji":"📡","requires":{"bins":["starlink"]},"install":[{"id":"cargo","kind":"cargo","git":"https://github.com/danfedick/starlink-cli","bins":["starlink"],"label":"Install starlink-cli (cargo)"}]}}

bash

cargo install --git https://github.com/danfedick/starlink-cli

Technical Analysis

The Skill installs executable source directly from a mutable Git repository without specifying an immutable commit revision. Consequently, the code downloaded at installation time may differ from the code available when the Skill was reviewed.

cargo install --git downloads and compiles repository-controlled Rust code. Compilation can execute Cargo build scripts supplied by the repository. If the upstream repository or its maintainer account is compromised, an attacker can introduce malicious source code or build logic that executes during installation or when the resulting binary is invoked.

The audit did not establish that the current upstream repository is malicious. The vulnerability is the absence of immutable source pinning and integrity verification, which leaves installation behavior dependent on future mutable repository state.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying its default branch.
2. The attacker commits a malicious Cargo build script or modifies the application source.
3. A user or agent follows the Skill installation instructions or triggers its configured Cargo installer.
4. Cargo retrieves the attacker-controlled default-branch revision from the remote repository.
5. Cargo compiles the source, potentially executing malicious build-time code.
6. The malicious code runs with the privileg ...[truncated 728 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the Git installation to a reviewed, immutable full commit hash:

  bash

  cargo install --git https://github.com/danfedick/starlink-cli --rev FULL_REVIEWED_COMMIT_HASH
  

• Add the same immutable revision to the Skill's installer metadata rather than referencing only the repository URL.

• Review the pinned source tree, including Cargo.toml, dependency declarations, procedural macros, and Cargo build scripts.

• Prefer a versioned, signed release or a trusted package registry when available.

• Verify release signatures or cryptographic checksums before installation.

• Use dependency lockfiles and automated supply-chain scanning where supported.

• Perform compilation in a restricted, nonprivileged environment with limited filesystem, credential, and network access.

• Require a deliberate update and security review before changing the pinned revision.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill for broad requests like 'internet status' or 'connected devices,' which can match generic networking questions not specifically about Starlink hardware. That can cause the agent to invoke a capability-bearing local-control tool in situations where the user only wanted general advice, increasing the chance of unnecessary device interrogation or follow-on operational actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documents disruptive operations like stow/unstow and reboot but provides no warning that these actions can interrupt connectivity or affect dish operation. In an agent setting, omission of confirmation and impact warnings can lead to accidental denial of service against the user's internet connection or unintended physical/operational changes to equipment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes GPS location retrieval and even explains how to enable it, but it does not warn that precise location data is sensitive personal information. In an agent context, this increases privacy risk because the skill can normalize collecting or revealing a user's physical location without emphasizing consent, minimization, or careful handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.