Security audit

index1

Security checks for vulnerabilities and agentic risk

Overview

The skill's memory and code-search purpose is clear, but its installation guidance includes unsafe remote-shell and unpinned package installation patterns users should review carefully.

Install only if you are comfortable with a tool that can index project files and store persistent agent memory. Avoid running the curl-to-shell Ollama command as written; use a verified installer or package-manager path instead. Prefer pinned, reviewed versions rather than latest, and review any auto-configured MCP hooks or project agent rules before relying on them.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:103
Finding: Unverified Remote Installer Is Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:26
Finding: Package Installation Instructions Use Unpinned Dependency Versions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: curl -fsSL https://ollama.com/install.sh | sh is a classic remote code execution pattern: it fetches shell code over the network and executes it immediately. In a skill designed for coding agents, this is especially risky because agents may follow setup instructions semi-automatically, amplifying the chance of unreviewed code execution on developer systems.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
index1 v2 has built-in ONNX embedding (bge-small-en-v1.5). For better multilingual support:

bash
curl -fsSL https://ollama.com/install.sh | sh ollama pull nomic-embed-text # Standard, 270MB # or ollama pull bge-m3 # Best for CJK, 1.2GB

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | sh chaining pattern removes the opportunity for inspection between download and execution, making any compromise of the remote source immediately exploitable. Because this appears in installation guidance, it normalizes unsafe operational behavior and can lead to host compromise, credential theft, or persistence if copied into a real shell.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
index1 v2 has built-in ONNX embedding (bge-small-en-v1.5). For better multilingual support:

bash
curl -fsSL https://ollama.com/install.sh | sh ollama pull nomic-embed-text # Standard, 270MB # or ollama pull bge-m3 # Best for CJK, 1.2GB

Rp1

Medium

Category: MCP Rug Pull
Confidence: 77% confidence
Finding: The installation guidance uses npx index1@latest, which pulls and executes the latest package version at runtime rather than a pinned, reviewed release. In an agent skill context, this increases supply-chain risk because users or agents may automatically run whatever code is currently published under that package name.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to pipe a remotely fetched shell script directly into sh without any warning, review step, or integrity check. This is dangerous because it executes arbitrary code from a network source immediately, and if the remote endpoint or delivery path is compromised, the host running the command can be fully compromised.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.