Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do what it says, but its install instructions ask users to run an unverified remote installer, which warrants review before installing.
Review the installer source before running it, prefer a pinned release or `cargo install toll --version 1.0.5` if available, and remember the tool is intended to read local Claude Code and Codex CLI session logs to calculate usage and costs.
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
Location
SKILL.md:24
Finding
Mutable Remote Installation Script Executed Directly Through a Shell
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, line 24 Vulnerability Type: Remote payload retrieval and execution Risk Level: High
Vulnerable Code:
bash
# Quick install (Linux/macOS)
curl -fsSL https://raw.githubusercontent.com/Fullstop000/toll/refs/heads/master/install.sh | sh
Technical Analysis
The installation instructions download a shell script from the mutable master branch of a personal GitHub repository and immediately pipe it to sh. The command does not pin a commit or release, verify a cryptographic signature or checksum, or allow the user to inspect the downloaded content before execution.
Consequently, the effective code executed by this Skill can change after the Skill itself has been reviewed. Compromise of the repository, maintainer account, GitHub delivery path, or referenced installation script could turn the documented installation command into an arbitrary code-execution channel.
Installing the utility may be necessary for the declared token-reporting functionality, but executing a mutable remote script is not the minimum privilege or minimum-risk installation mechanism required. A pinned and verified package or release artifact would provide the required functionality without blindly executing remotely controlled shell code.
Attack Path
A user invokes the Skill on a system where toll is not installed.
The Skill runs or recommends running toll --version, which fails.
The user follows the documented quick-install command.
curl retrieves the current contents of install.sh from the mutable master branch.
The response is passed directly to sh without inspection or integrity verification.
If the repository or delivery source has been compromised, attacker-controlled commands execute with the privileges of the invoking user.
Impact Assessment
A malicious installation script could execute arbitrary commands with the current use
...[truncated 462 chars]
Remediation
View remediation
Remediation Suggestions
Remove the curl | sh installation pattern.
Prefer a trusted package manager or a versioned release artifact.
Pin installation to an immutable release version or commit rather than master.
Publish cryptographic checksums or signatures through a separately authenticated channel and verify them before execution.
Download the installer to a local file, verify it, and permit inspection before running it.
Do not invoke installation automatically. Require explicit user approval after clearly identifying the source and requested actions.
Document the files, directories, and permissions modified by installation.
The actual release URL and checksum must come from a trusted, immutable release process.
T08 · Insecure Dependencies
Warning
Location
SKILL.md:27
Finding
Unpinned Cargo Dependency Installation
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, line 27 Vulnerability Type: Insecure dependency installation Risk Level: Medium
Vulnerable Code:
bash
# Or via cargo
cargo install toll
Technical Analysis
The Cargo installation alternative does not specify an exact package version or a locked dependency resolution. It therefore installs whichever release is current when the command is run rather than the Skill’s declared version 1.0.5.
This creates supply-chain drift: later package releases and their transitive build dependencies may differ from what was reviewed when the Skill was published. Cargo packages can execute compilation-related code during installation, including build scripts, so a compromised future release or dependency could execute code under the installing user’s account.
No evidence in the audited file establishes that the current toll Cargo package is malicious. The confirmed weakness is the absence of version pinning and integrity controls, which prevents reproducible installation and expands trust to future package versions.
Attack Path
A user invokes the Skill without toll installed.
The user selects the documented Cargo installation method.
Cargo resolves the package name to the registry’s current release and resolves its dependency graph at installation time.
If a future package release, maintainer account, or transitive dependency is compromised, Cargo downloads and builds the affected content.
Malicious build-time or installed code executes with the privileges of the invoking user.
Impact Assessment
Exploitation could permit arbitrary code execution as the installing user during compilation or later when the installed toll binary is invoked. Accessible data could include user files, development credentials, environment variables, and the Claude Code or Codex logs the tool is expected to process. The instruction does not establish
...[truncated 47 chars]
Remediation
View remediation
Remediation Suggestions
Pin the package to the Skill’s reviewed version:
bash
cargo install toll --version 1.0.5
Confirm that the registry package is controlled by the expected project maintainer and corresponds to the linked source repository.
Use locked dependency resolution where the project’s supported installation workflow permits it.
Publish and verify reproducible release artifacts, checksums, or signatures.
Review dependencies and Cargo build scripts before recommending installation.
Update the pinned version only after reviewing the new release and its dependency changes.
The | sh construct causes arbitrary remote content to be executed immediately in the user's shell. In a skill context, this is especially dangerous because the agent may encourage or automate command execution, increasing the chance that unreviewed code runs with the user's privileges.
Content
Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
bash
# Quick install (Linux/macOS)
curl -fsSL https://raw.githubusercontent.com/Fullstop000/toll/refs/heads/master/install.sh | sh
# Or via cargo
cargo install toll
External Script Fetching
Low
Category
Supply Chain
Confidence
97% confidence
Finding
The skill instructs users to install the tool by piping a remotely fetched script directly into sh. This bypasses review of the downloaded content, trusts the current contents of a mutable remote branch (master), and creates a supply-chain risk if the repository, network path, or hosting account is compromised.
Content
Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
bash
# Quick install (Linux/macOS)
curl -fsSL https://raw.githubusercontent.com/Fullstop000/toll/refs/heads/master/install.sh | sh
# Or via cargo
cargo install toll
