Wander

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:10 AM UTC
• Version: 1.0.7

Overview

The skill is coherent as a GitHub Actions monitoring aid, but its install instructions ask users to run mutable third-party scripts from an unpinned GitHub repository and put them on PATH.

Review this skill before installing. Its monitoring concept is reasonable, but the current instructions rely on executable shell scripts fetched from an unpinned external GitHub repository and made persistent in your shell PATH. Prefer a pinned commit or vendored, reviewed scripts, and only allow reruns for workflows you are comfortable re-executing, especially if they deploy, publish, or modify production resources.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:144

Finding

Unpinned Remote Repository Is Downloaded and Exposed as Executable Tooling

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 144-155
Vulnerability Type: Remote payload retrieval and execution through mutable upstream content
Risk Level: High

Vulnerable Code

bash

git clone https://github.com/ERerGB/wander.git ~/code/wander
cd ~/code/wander && chmod +x *.sh

bash

export WANDER_HOME="${WANDER_HOME:-$HOME/code/wander}"
export PATH="$WANDER_HOME:$PATH"
alias wf='watch-workflow.sh'
alias wfbg='watch-workflow-bg.sh'
alias wfdt='watch-workflow-detached.sh'

Technical Analysis

The installation instructions clone the current contents of an external GitHub repository without pinning a reviewed commit, signed tag, release artifact, or cryptographic checksum. They then mark every root-level shell script as executable and instruct the user to place the cloned directory at the beginning of PATH.

The executable scripts are not included in the audited package, which contains only README.md and SKILL.md. Consequently, their behavior cannot be verified by this audit, and the effective payload can change independently after the Skill package has been reviewed or published.

Prepending the mutable directory to PATH also causes matching commands in that directory to take precedence over system commands. Although no spoofed tools were observed in the packaged files, a compromised upstream repository could introduce additional executable files that are selected during subsequent shell command resolution.

Attack Path

1. An attacker compromises the referenced GitHub repository, a maintainer account, or another mechanism capable of changing its default branch.
2. The attacker adds malicious behavior to one of the documented watcher scripts or adds another executable shell script.
3. A user or Agent follows the installation instructions and clones the mutable default branch.
4. The broad chmod +x *.sh command makes all root-level shell scripts exe ...[truncated 945 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor the required scripts into the Skill package so that the exact executable content is included in security review.
2. If remote retrieval is necessary, pin the repository to a specific immutable commit hash rather than cloning and executing the current default branch.
3. Publish checksums for all executable files and verify them before granting execute permission or running them.
4. Prefer signed release artifacts or signed Git tags and verify their signatures against a documented trusted maintainer key.
5. Replace chmod +x *.sh with explicit permissions for the required files only, such as the three named watcher scripts.
6. Avoid prepending a mutable third-party directory to global PATH. Invoke verified scripts through explicit absolute paths or install narrowly scoped wrappers in a controlled directory.
7. Document a fixed, reviewed version and provide an explicit upgrade process so that upstream changes require separate review before execution.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is framed as a monitoring/notification aid, but it also documents gh run rerun <RUN_ID> --failed, which is an operational control that can re-execute remote workflows. In an agent context, this expands capability from passive observation to state-changing action, increasing the chance the agent retriggers builds, deploys, or release steps without explicit user approval or policy checks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.