Security audit

Standalone Setup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed VPS setup helper for Mobazha; it is powerful because it uses SSH and a remote sudo installer, but that matches its stated purpose.

Install only if you are comfortable letting an agent administer the specified VPS and you trust Mobazha's installer. Review the remote script before running it, confirm the exact server and domain, avoid sharing reusable SSH credentials, and inspect or disable the hourly auto-update timer if you need manual change control.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (17)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The document repeatedly instructs users to pipe a remotely fetched script directly into a root shell, but provides no warning about executing unreviewed code with full system privileges. In a setup/install skill, this context makes the pattern more dangerous because users are likely to copy-paste the command verbatim on production VPS hosts, turning any compromise of the download endpoint or installer into immediate root-level code execution.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: # Standalone Installer Flags Reference Source: `curl -sSL https://get.mobazha.org/standalone | sudo bash [options]` ## Available Flags
Confidence: 89% confidence
Finding: This line documents running the installer via sudo, which grants root privileges to whatever code is fetched from the network. While privileged installation may be operationally necessary, combining it with an unverified remote script makes this materially unsafe for end users.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash # With domain — HTTPS auto-TLS curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com # Privacy mode curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor
Confidence: 90% confidence
Finding: The example encourages executing installation steps as root through sudo without any verification or warning. In deployment documentation, users often copy commands exactly, so this increases the chance of unsafe privileged execution on real systems.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com # Privacy mode curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor # Combined curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com --overlay tor --testnet
Confidence: 90% confidence
Finding: This example uses sudo to run a remote installer with additional options, extending the same privileged execution risk to privacy-mode deployments. The problem is not the flag itself but that root execution is granted to unaudited network-delivered code.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor # Combined curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com --overlay tor --testnet # Custom install directory INSTALL_DIR=/srv/mobazha curl -sSL https://get.mobazha.org/standalone | sudo bash
Confidence: 90% confidence
Finding: The custom install directory example still pipes a remote script into sudo bash, so changing the destination does nothing to reduce the risk of arbitrary root command execution. If the installer or host is tampered with, the entire VPS can be compromised.

External Script Fetching

High

Category: Supply Chain
Content: # Standalone Installer Flags Reference Source: `curl -sSL https://get.mobazha.org/standalone | sudo bash [options]` ## Available Flags
Confidence: 99% confidence
Finding: The source line explicitly recommends fetching a script over the network and immediately executing it as root. This is dangerous because it eliminates any opportunity to verify integrity, inspect behavior, or pin a trusted version, so compromise of the server, TLS trust chain, DNS, or content delivery path can become instant root RCE.

External Script Fetching

High

Category: Supply Chain
Content: ```bash # Basic install — HTTP on IP curl -sSL https://get.mobazha.org/standalone | sudo bash # With domain — HTTPS auto-TLS curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com
Confidence: 99% confidence
Finding: The basic install example is a direct copy-pasteable remote code execution pattern with root privileges. Because this is installer documentation, the likelihood of user execution is high, making the practical exploitation risk substantial.

External Script Fetching

High

Category: Supply Chain
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash # With domain — HTTPS auto-TLS curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com # Privacy mode curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor
Confidence: 99% confidence
Finding: This domain-based install example preserves the same unsafe fetch-and-execute pattern, only adding arguments. Any attacker controlling or intercepting the installer payload would gain full root access regardless of the provided domain flag.

External Script Fetching

High

Category: Supply Chain
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com # Privacy mode curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor # Combined curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com --overlay tor --testnet
Confidence: 99% confidence
Finding: The privacy overlay example still pipes untrusted remote content to a root shell. The privacy-focused context may even encourage risk-tolerant users to accept unsafe setup steps, increasing the chance of exploitation on sensitive deployments.

External Script Fetching

High

Category: Supply Chain
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor # Combined curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com --overlay tor --testnet # Custom install directory INSTALL_DIR=/srv/mobazha curl -sSL https://get.mobazha.org/standalone | sudo bash
Confidence: 99% confidence
Finding: The combined-flags example remains a direct remote-to-root execution path, with additional complexity that could distract users from the underlying security risk. Compromise of the installer source would allow arbitrary root actions independent of the chosen options.

External Script Fetching

High

Category: Supply Chain
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com --overlay tor --testnet # Custom install directory INSTALL_DIR=/srv/mobazha curl -sSL https://get.mobazha.org/standalone | sudo bash ``` ## Post-Install Locations
Confidence: 99% confidence
Finding: Even the custom install directory example uses the same unsafe pattern, so users may incorrectly infer that customization equals safety. In reality, the installer still runs arbitrary network-provided code as root and can modify any part of the system.

Chaining Abuse

High

Category: Tool Misuse
Content: # Standalone Installer Flags Reference Source: `curl -sSL https://get.mobazha.org/standalone | sudo bash [options]` ## Available Flags
Confidence: 98% confidence
Finding: The shell pipeline chains network retrieval directly into a privileged interpreter, which is a classic high-risk abuse pattern because it removes inspection and creates a single-step path to code execution. In installer docs, this pattern is especially dangerous due to high user trust and copy-paste behavior.

Chaining Abuse

High

Category: Tool Misuse
Content: ```bash # Basic install — HTTP on IP curl -sSL https://get.mobazha.org/standalone | sudo bash # With domain — HTTPS auto-TLS curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com
Confidence: 98% confidence
Finding: This example demonstrates command chaining from curl to sudo bash in one line, which materially increases exploitability by making dangerous behavior effortless for users. If the fetched content is malicious, the pipeline ensures it runs immediately with elevated privileges.

Chaining Abuse

High

Category: Tool Misuse
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash # With domain — HTTPS auto-TLS curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com # Privacy mode curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor
Confidence: 98% confidence
Finding: The domain example continues the same chain-abuse pattern, so the presence of useful installer flags does not mitigate the execution risk. A single compromised response can still fully own the target host via the chained privileged shell.

Chaining Abuse

High

Category: Tool Misuse
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com # Privacy mode curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor # Combined curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com --overlay tor --testnet
Confidence: 98% confidence
Finding: The overlay example again chains download and root execution into a one-liner, preserving the same abuse path. This is particularly risky for users deploying privacy-oriented infrastructure, where host compromise may have broader confidentiality implications.

Chaining Abuse

High

Category: Tool Misuse
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --overlay tor # Combined curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com --overlay tor --testnet # Custom install directory INSTALL_DIR=/srv/mobazha curl -sSL https://get.mobazha.org/standalone | sudo bash
Confidence: 98% confidence
Finding: The combined example is still a direct chained execution primitive and remains exploitable regardless of argument complexity. The convenience of the one-liner increases the chance it will be used unchanged on Internet-facing VPS systems.

Chaining Abuse

High

Category: Tool Misuse
Content: curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com --overlay tor --testnet # Custom install directory INSTALL_DIR=/srv/mobazha curl -sSL https://get.mobazha.org/standalone | sudo bash ``` ## Post-Install Locations
Confidence: 98% confidence
Finding: This custom directory example preserves the same dangerous chain from remote fetch to root shell. The installation context makes it more dangerous, not less, because the docs normalize a risky pattern as the standard setup method.

Static analysis

No suspicious patterns detected.