T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:68- Finding
Installation instructions execute mutable remote scripts without integrity verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Skills Audit
Security checks for vulnerabilities and agentic risk
Overview
This audit skill is mostly coherent, but its installer uses unsafe remote execution and can delete and reclone an existing install without confirmation.
Do not use the README one-line install commands as written. Prefer cloning or downloading a reviewed, pinned release, verify it before running any script, and back up your skill directories before updates. When running the skill, review the action list carefully before approving archive, install, update, or description changes, and avoid the PR CI template on untrusted contributions unless web-enabled tools and external-agent access are restricted.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:34- Finding
Shell installer destructively deletes the existing installation after any update failure
- Content
View full analysis
/dev/null || { cd "$HOME" && rm -rf "$INSTALL_DIR" && git clone "$REPO_SSH" "$INSTALL_DIR" 2>/dev/null || git clone "$REPO_HTTPS" "$INSTALL_DIR"; } else echo " Cloning..." mkdir -p "$(dirname "$INSTALL_DIR")" git clone "$REPO_SSH" "$INSTALL_DIR" 2>/dev/null || git clone "$REPO_HTTPS" "$INSTALL_DIR" fi ``` ### Technical Analysis Any failure of `git pull --rebase` triggers recursive deletion of the existing installation and replaces it with a fresh clone. Pull failure is not limited to corruption: it may occur because of local modifications, merge conflicts, authentication problems, network errors, or remote repository problems. Although `INSTALL_DIR` is generated by `detect_platform`, the script does not canonicalize the path, verify ownership, reject symbolic links, create a backup, or request confirmation before `rm -rf`. Local modifications and untracked runtime data within the installation can therefore be destroyed. The subsequent clone also retrieves mutable content without pinning or integrity verification. The Skill already declares snapshot and rollback functionality for operational changes, but this installer does not apply equivalent safeguards to updates. ### Attack Path 1. A user has an existing installation, potentially containing local changes or untracked data. 2. `git pull --rebase` fails because of a conflict, network failure, repository manipulation, or another ordinary update error. 3. The failure handler executes `rm -rf "$INSTALL_DIR"` without confirmation or backup. 4. The installer clones the current remote repository into the deleted location. 5. Existing local content is lost and replaced by mutab ...[truncated 402 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install.ps1:29- Finding
PowerShell installer destructively removes the existing installation after update failure
- Content
View full analysis
$null } catch { Pop-Location Remove-Item -Recurse -Force $InstallDir -ErrorAction SilentlyContinue try { git clone $RepoSSH $InstallDir } catch { git clone $RepoHTTPS $InstallDir } } Pop-Location } else { Write-Host " Cloning..." New-Item -ItemType Directory -Force -Path (Split-Path $InstallDir) | Out-Null try { git clone $RepoSSH $InstallDir } catch { git clone $RepoHTTPS $InstallDir } } ``` ### Technical Analysis The update error handler recursively and forcibly removes the complete installation directory after any `git pull --rebase` failure. No distinction is made between ordinary merge conflicts, local changes, connectivity failures, authentication errors, and actual installation corruption. The script does not back up the directory, obtain user confirmation, validate whether the path resolves through a reparse point or symbolic link, or preserve local changes. It then replaces the directory with content from a mutable remote branch. The control flow also calls `Pop-Location` inside the error handler and again after it, which can produce an additional location-stack error under `$ErrorActionPreference = "Stop"`. ### Attack Path 1. A user runs the installer against an existing installation. 2. The Git update fails because of local modifications, a network error, repository manipulation, or another update problem. 3. The catch block executes `Remove-Item -Recurse -Force` against the installation directory. 4. The current installation and its local contents are removed without confirmation. 5. The installer clones mutable remote content into the deleted locat ...[truncated 457 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (95)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashpattern is a classic dangerous command chain because it turns a network fetch directly into shell execution with no inspection boundary. In a developer-tooling/skill ecosystem, users may run these commands in privileged environments or on workstations containing sensitive credentials, amplifying the blast radius of any upstream compromise.- Content
Installation / 安装
bash curl -sL https://raw.githubusercontent.com/gtbwpkwjnb-alt/skills-audit-skill/main/install.sh | bashWindows PowerShell:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented primarily as an audit/reporting utility, but the content also authorizes installation, update, rollback, and local skill-directory modification behavior. That mismatch is dangerous because users may invoke what appears to be a passive audit skill while actually enabling shell execution and filesystem changes, increasing the chance of unintended code retrieval or local modification.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented primarily as an audit/reporting utility, but the content also authorizes installation, update, rollback, and local skill-directory modification behavior. That mismatch is dangerous because users may invoke what appears to be a passive audit skill while actually enabling shell execution and filesystem changes, increasing the chance of unintended code retrieval or local modification.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 多 `SKILL.md` + `MEMORY.md` → `AI Agent 技能开发`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The
| bashpattern is a classic chaining risk because it directly streams remote content into a shell interpreter, bypassing review and creating immediate code-execution exposure. In an installer context, this is especially dangerous because users are primed to run it with trust and it can execute arbitrary commands affecting their environment, files, and credentials.- Content
sh #!/bin/bash # skills-audit installer — curl -sL https://raw.githubusercontent.com/gtbwpkwjnb-alt/skills-audit-skill/main/install.sh | bash set -e
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
This command chain combines a failed
git pullwithcd "$HOME" && rm -rf "$INSTALL_DIR" && git clone ..., making deletion and reinstallation automatic in a single fallback path. Such chaining reduces operator visibility and can turn a transient update error into destructive data loss or unsafe replacement of an existing installation.- Content
sh if [ -d "$INSTALL_DIR" ]; then echo " Already installed. Updating..." cd "$INSTALL_DIR" git pull --rebase 2>/dev/null || { cd "$HOME" && rm -rf "$INSTALL_DIR" && git clone "$REPO_SSH" "$INSTALL_DIR" 2>/dev/null || git clone "$REPO_HTTPS" "$INSTALL_DIR"; } else echo " Cloning..." mkdir -p "$(dirname "$INSTALL_DIR")"
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
yaml # Codex 特有配置 codex: skills_dir: "~/.codex/skills/" config_file: "~/.codex/config.toml" # Codex 当前技能生态较新，外部信号可能不丰富，建议降低 Community 阈值 community_min_stars: 5 # 默认100→降低到5（生态新）
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The workflow invokes an external LLM/agent CLI in CI and explicitly grants it WebSearch/WebFetch capabilities. In a PR-triggered context, this can expose repository content or metadata to a third-party model/provider and can cause unreviewed outbound network access based on adversarial repository inputs, increasing supply-chain and data-exfiltration risk.
- Content
yaml id: audit run: | # Claude Code headless 模式 claude -p "运行 skills-audit --ci --output-format json" \ --output-format json \ --max-turns 15 \ --allowedTools "Read,Grep,WebSearch,WebFetch" \
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 95% confidence
- Finding
The file begins with a hidden Unicode BOM/non-printing character, which can conceal content differences and interfere with parsers, diff tools, or security scanning pipelines. In an agent skill flow document, hidden characters increase the risk of instruction smuggling or inconsistent interpretation between tools, especially in CI/CD and automated audit contexts.
- Content
md # ⑥ 生成报告 **评分快照即时持久化**：报告输出前立即持久化评分快照到 .data/stats.json。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 95% confidence
- Finding
The file begins with a hidden BOM/invisible character, which can constitute a hidden-instruction pattern because non-printing characters may interfere with parsing, diff review, or downstream tooling. In this specific context the content is not overtly malicious and actually enforces explicit user confirmation, so the danger is limited, but invisible leading characters still create avoidable ambiguity in security-sensitive workflow files.
- Content
md # ⑦-b 用户确认 展示操作清单（含快照路径），等待用户确认后执行。任何修改操作均需用户明确确认。
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template explicitly labels English-only descriptions as noncompliant and instructs conversion to Chinese, which imposes a language policy on content rather than evaluating security or functional quality. In a skill-auditing tool, this is more dangerous because it can systematically rewrite metadata, misclassify valid skills as defective, and trigger bulk changes that damage multilingual repositories or violate organizational localization rules.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
yaml - name: "summarize" version: "6.8.0" category: docs tags: ["summary", "session", "context", "token-tracking", "error-harvest", "self-evolve", "compress", "cross-agent"] description: "总结 → 错误收割·自进化·可逆压缩 | Summarize → error harvest·self-evolve·compress" source: "local" homepage: "https://github.com/gtbwpkwjnb-alt/summarize-skill"
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
yaml - name: "summarize" version: "6.8.0" category: docs tags: ["summary", "session", "context", "token-tracking", "error-harvest", "self-evolve", "compress", "cross-agent"] description: "总结 → 错误收割·自进化·可逆压缩 | Summarize → error harvest·self-evolve·compress" source: "local" homepage: "https://github.com/gtbwpkwjnb-alt/summarize-skill"
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 分层测试 — T1/T2/T3 + T3 活性验证 > 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Static analysis
No suspicious patterns detected.