ClawHub
Back to skill

Security audit

airq

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent air-quality CLI helper, but its documented install path asks users to trust mutable remote binaries and place one in a system command directory with sudo.

Review the install commands before using this skill. Prefer a pinned version, verify checksums or signatures from the upstream project, and install to a user-local directory instead of using sudo to place an unverified binary in /usr/local/bin. The config and cache paths are disclosed and expected, but users who care about location history or report files should review and clear ~/.config/airq and ~/.cache/airq as needed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:21
Finding

Unverified Remote Executable Installation from Mutable Distribution Channels

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–35
Vulnerability Type: Remote payload retrieval and insecure dependency installation
Risk Level: High

Vulnerable Code:

bash
### macOS (Homebrew)
brew tap fortunto2/tap && brew install airq

### Linux (prebuilt binary)
curl -LO https://github.com/fortunto2/airq/releases/latest/download/airq-linux-x86_64.tar.gz
tar xzf airq-linux-x86_64.tar.gz
sudo mv airq /usr/local/bin/

### Any platform (Rust/cargo)
cargo install airq

Technical Analysis

The Skill instructs the Agent to retrieve and install executable software from external, mutable distribution channels. The Linux procedure downloads the latest release from a personal GitHub account without pinning a version or validating a cryptographic signature or checksum. Because the latest target can be changed after this Skill is reviewed, the code ultimately executed by the user is not represented by the audited project.

The Homebrew command similarly trusts a third-party personal tap, while cargo install airq does not pin a reviewed package version. A compromise of the maintainer account, repository, release artifacts, Homebrew tap, or registry package could therefore substitute malicious code.

The Linux workflow further invokes sudo to place the downloaded executable in /usr/local/bin. Although the executable itself is not explicitly run with elevated privileges, modifying a global command directory exceeds the minimum permissions needed for an air-quality utility and exposes all users or automation resolving that command to the installed binary.

Attack Path

  1. An attacker compromises the upstream maintainer account, repository, release workflow, personal Homebrew tap, or relevant package publication credentials.
  2. The attacker replaces the mutable latest archive, Homebrew package definition, or unpinned Cargo package with a malicious version.
  3. The Agent ...[truncated 1418 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin an exact, reviewed release version rather than using the mutable latest URL.
  2. Publish SHA-256 checksums through an independently protected channel and verify the downloaded archive before extraction.
  3. Prefer cryptographically signed releases and validate the signature against a documented maintainer key.
  4. Pin an exact Cargo package version and use a locked, reviewed dependency set where feasible.
  5. Use only trusted or formally verified package repositories instead of an unaudited personal tap.
  6. Avoid sudo and install the executable into a user-controlled directory such as ~/.local/bin.
  7. Extract into a newly created private directory and validate archive paths, file types, names, and expected contents before installation.
  8. Document the expected executable hash and provenance so future audits can establish that the installed artifact matches the reviewed release.
  9. If privileged system-wide installation is genuinely required, obtain explicit user approval and use a trusted package manager with signature and ownership verification.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use the skill when the user asks about 'air quality, pollution, AQI scores, or wants to monitor air in their city.' Terms like 'pollution' and 'monitor air in their city' are broad natural-language cues that could overlap with general conversation and do not define clear activation boundaries or exclusions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The Linux installation path downloads a release archive over the network and then moves a binary into /usr/local/bin using sudo, but provides no integrity verification, provenance check, or warning before privileged execution. If the download source is compromised, redirected, or tampered with, the user could install and trust a malicious binary system-wide.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill instructs users to run sudo mv on a downloaded executable, effectively elevating unverified code into a trusted system path. In the context of an install workflow, this increases risk because users may follow the commands verbatim, turning any compromised download into persistent code execution with broad trust and easy future invocation.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

bash
curl -LO https://github.com/fortunto2/airq/releases/latest/download/airq-linux-x86_64.tar.gz
tar xzf airq-linux-x86_64.tar.gz
sudo mv airq /usr/local/bin/

Any platform (Rust/cargo)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The markdown tells the user to run 'airq init --city ' and states that it creates ~/.config/airq/config.toml, but it does not clearly warn that this writes persistent configuration to disk. Because this affects user data on the filesystem, the behavior should be disclosed more explicitly in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes generating self-contained HTML/PDF reports and later notes that data is cached in ~/.cache/airq/, but it does not present this as a user-facing warning about local file creation and cached data retention. Since the behavior creates files and stores downloaded data locally, a clearer warning would improve transparency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.