T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:64- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
asale-buy-gemini-cli
Security checks for vulnerabilities and agentic risk
Overview
The skill's stated purpose is coherent, but installing or updating it runs an unverified remote script and it changes Gemini CLI configuration, so users should review it carefully first.
Before installing, review the asale installer source or use a verifiable release path if available. Expect this skill to read the local asale daemon token, talk to the local daemon, inspect Gemini CLI process state, and change Gemini CLI configuration so future Gemini sessions may route through asale.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL-cn.md:59- Finding
Localized Documentation Executes an Unverified Remote Installer
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The metadata recommends installation via 'curl ... | sh' and PowerShell 'iex', which execute remote code directly without integrity verification or review. If the distribution endpoint, network path, or hosting account is compromised, users can be transparently infected with arbitrary code execution.
- Content
md name: asale-buy-gemini-cli version: 0.2.7 description: "Switch Gemini CLI between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Gemini CLI，并查看哪些正在运行的会话还用着旧配置。" metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool gemini. tool_processes is listing only — never signal those pids."}} --- # asale-buy-gemini-cli
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs the agent to modify Gemini CLI user configuration files under ~/.gemini, including endpoint and API key settings. This is a high-risk capability because it changes security-relevant local config for another tool and can redirect traffic or alter credential usage, even if the stated purpose is legitimate.
- Content
call set_buy_tool '{"tool":"gemini","enabled":true}'
text 不传 `models` 就保持当前选择，传 `[]` 是清空。会改写的配置：`~/.gemini/.env`（`GOOGLE_GEMINI_BASE_URL` / `GEMINI_API_KEY`）和 `~/.gemini/settings.json`。 ### 3. 说清楚哪些会话还在用旧配置
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The installation method executes a remote script directly from the network via 'curl ... | sh' (and PowerShell 'iex' on Windows), giving the remote server full code execution on the user's machine without prior verification. If the hosting infrastructure, DNS, TLS trust chain, or upstream release process is compromised, users receive arbitrary malicious code immediately.
- Content
md name: asale-buy-gemini-cli version: 0.2.7 description: "Switch Gemini CLI between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Gemini CLI，并查看哪些正在运行的会话还用着旧配置。" metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool gemini. tool_processes is listing only — never signal those pids."}} --- # asale-buy-gemini-cli
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [English](./SKILL.md) · [中文](./SKILL-cn.md)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 94% confidence
- Finding
The skill is designed to rewrite Gemini CLI configuration files under the user's home directory, including ~/.gemini/.env and ~/.gemini/settings.json. Modifying another tool's auth and endpoint configuration is security-sensitive because it can redirect traffic, alter billing behavior, and affect future sessions; if the daemon or skill behavior is compromised, this becomes a high-impact local configuration hijack.
- Content
text `models` omitted leaves the current selection alone; `[]` clears it. Config rewritten: `~/.gemini/.env` (`GOOGLE_GEMINI_BASE_URL` / `GEMINI_API_KEY`) and `~/.gemini/settings.json`. ### 3. Say which sessions are still on the old config
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text