apix

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:01 AM UTC
• Version: 1.0.0

Overview

The skill is coherent as an API-exploration helper, but its install instructions include unverified remote shell execution and its API-call workflow lacks clear guardrails for state-changing requests.

Review before installing. Prefer the Homebrew path or a verified release over the curl-to-shell installer, and do not let an agent run state-changing apix call commands unless you have checked the endpoint, method, auth, payload, and expected side effects.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:28

Finding

Unverified Remote Installer Is Piped Directly to a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 28
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://apix.sh/install | sh

Technical Analysis

The installation instruction downloads mutable content from an external server and immediately executes it with sh. The command does not pin a release, verify a cryptographic checksum or signature, preserve the script for inspection, or otherwise authenticate the payload beyond the HTTPS connection.

Because the remote installer is not included in the audited project, its behavior cannot be statically reviewed. Its contents may also change after this Skill has been reviewed. The resulting execution therefore depends on the current behavior and security of the remote server, its deployment pipeline, and the DNS/TLS trust chain.

This behavior exceeds the minimum privileges necessary for the declared API-exploration functionality. The document already provides a Homebrew installation method, while the pipe-to-shell alternative grants mutable remote content immediate command execution under the invoking account.

Attack Path

1. An agent loads this Skill and determines that apix is not installed.
2. Following the documented alternative, it runs curl -fsSL https://apix.sh/install | sh.
3. The external endpoint, or a compromised component in its distribution infrastructure, returns attacker-controlled shell commands.
4. The commands are passed directly to sh without local review or integrity verification.
5. The payload executes with the privileges and environment of the user or agent process.

Impact Assessment

A malicious or compromised installer could execute arbitrary commands with the invoking account's privileges. Depending on that account's permissions and exposed environment, this could allow filesystem modification, credential or token theft, replacement of loc ...[truncated 295 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the pipe-to-shell installation instruction.
2. Prefer a trusted package manager installation using a version-pinned release where supported.
3. If direct installation is necessary, download a fixed-version artifact or installer as a separate step rather than executing streamed content.
4. Verify the downloaded file against a publisher-provided cryptographic checksum and, preferably, a validated release signature.
5. Preserve and inspect the installer before execution.
6. Run installation with ordinary user privileges and avoid sudo unless a specific operation demonstrably requires elevation.
7. Pin the download to an immutable release URL and document the expected checksum and signer identity in SKILL.md.
8. Consider sandboxing the installer and limiting its filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill recommends installing the tool via curl -fsSL https://apix.sh/install | sh, which fetches and immediately executes remote code without verification. This is a well-known supply-chain risk: if the server, DNS, TLS endpoint, or distribution pipeline is compromised, an agent or user could run attacker-controlled shell commands locally.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

brew install apix

text

Or via the curl installer:

```bash
curl -fsSL https://apix.sh/install | sh

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | sh construct chains untrusted network content directly into shell execution, eliminating any review boundary between retrieval and code execution. In an agent setting this is especially risky because automated workflows may follow such instructions verbatim, turning documentation text into immediate command execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Or via the curl installer:

bash

curl -fsSL https://apix.sh/install | sh

Agent Workflow Guidelines

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly instructs agents to execute live HTTP requests against discovered endpoints, but it does not warn that those calls may transmit sensitive data, mutate remote state, incur cost, or trigger side effects. In an agent context, this is dangerous because the tool is positioned as a direct execution path from documentation discovery to network action, increasing the chance of unintended external operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.