Requesthunt

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent research purpose, but its setup tells users to run a mutable remote installer directly in a shell, which needs review before installation.

Review the installer before using this skill. Prefer a pinned release or source build with independently verified checksums or signatures, run it as an unprivileged user, and provide the RequestHunt API key through an environment variable or protected config rather than hardcoding it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Unverified Remote Installer Executed Directly Through a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

bash

curl -fsSL https://requesthunt.com/cli | sh

Technical Analysis

The installation command retrieves a mutable shell script from https://requesthunt.com/cli and immediately passes it to sh. The remote response is neither version-pinned nor independently authenticated before execution, and piping it directly into a shell prevents meaningful review before it runs.

The documentation states that the installer downloads a binary from GitHub Releases and verifies its SHA-256 checksum. That downstream check does not secure the initial installer: the remotely delivered shell script is already executing and could omit or bypass verification, use an attacker-selected checksum, read credentials, modify files, or retrieve additional payloads.

This behavior exceeds the minimum privileges necessary for the Skill's research functionality. Installing a CLI does not require trusting and executing mutable shell code directly from a website; a pinned release artifact can instead be downloaded and independently verified.

Attack Path

1. A user or agent follows the prerequisite installation instructions.
2. curl requests the current response from requesthunt.com/cli.
3. An attacker who compromises the domain, server, deployment pipeline, or relevant delivery infrastructure alters that response.
4. The shell executes the modified response immediately with the invoking user's privileges.
5. The payload can bypass the claimed binary verification, inspect accessible data, alter user-owned files, steal credentials, establish persistence, or install additional software.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account that runs the installation command. The accessible scope includes that acc ...[truncated 678 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation path from the Skill instructions.
2. Direct users to a specific, immutable release version rather than a mutable website endpoint or floating latest release.
3. Publish the expected SHA-256 digest through a separately trusted channel and verify the downloaded artifact locally before installation.
4. Prefer cryptographically signed release artifacts and verify the signature against a documented, pinned public key.
5. If an installer script is unavoidable:
   • Download it to a local file without executing it.
   • Pin it to an immutable version or commit.
   • Verify its checksum or signature independently.
   • Review it before invoking a shell.
6. Do not request root or administrator privileges unless a narrowly defined installation step demonstrably requires them. Prefer installation into a user-owned directory.
7. For source installation, reference a pinned repository tag or commit and use locked dependencies rather than the unpinned example currently described.
8. Document the exact files, directories, and network endpoints used during installation so users can validate that installation remains within least-privilege boundaries.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs users to pipe a remote script directly into the shell via curl ... | sh, which executes network-fetched code without prior inspection. Even if the service is legitimate and claims checksum verification later, the bootstrap script itself is trusted implicitly, so a compromised server, CDN, DNS path, or publishing pipeline could lead to arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Install the CLI and authenticate:

bash

curl -fsSL https://requesthunt.com/cli | sh
requesthunt auth login

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | sh construct is the dangerous execution step that turns a remote content fetch into immediate shell execution. In an agent skill context this is especially risky because the instruction appears as an endorsed setup step, increasing the chance that an agent or operator runs it reflexively without review, enabling full command execution if the fetched content is malicious or tampered with.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Install the CLI and authenticate:

bash

curl -fsSL https://requesthunt.com/cli | sh
requesthunt auth login

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · examples/scheduling-tools-research-report.md (reported line 179)May include surrounding context.

md

**Representative Quotes:**
> "Currently, when an Event Type is set to 'Requires Confirmation,' the admin is blocked from approving a booking request if a conflicting event exists in that slot. An admin should be able to approve high-priority clients without changing the event settings temporarily." — @scopecreepsoap (GitHub)

**Opportunity**: Advanced routing rules + priority override system.

---

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:24