UV Global

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:06 AM UTC
• Version: 0.1.2

Overview

The skill is mostly coherent, but its installer gives too much unpinned installation authority for a shared persistent Python environment.

Review before installing. Prefer installing `uv` yourself through a trusted package manager, avoid running the curl fallback, and consider removing or pinning the default dependency bundle. Be careful before prepending `~/.uv-global/.venv/bin` to PATH because those helper commands and installed packages will persist across future tasks.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:6

Finding

Unverified Remote Installer Is Piped Directly Into a Shell

Content

View full analysis

/dev/null 2>&1 || brew install uv || (curl -LsSf https://astral.sh/uv/install.sh | sh) ``` ### Technical Analysis When `uv` is unavailable and `brew install uv` fails or cannot run, the script retrieves content from `https://astral.sh/uv/install.sh` and immediately executes it with `sh`. Although this domain is associated with the official `uv` project, the downloaded content is not pinned to a specific version and is not validated using a cryptographic checksum or signature. Consequently, the code that executes can change after the Skill has been reviewed. Piping a network response directly into a shell also prevents meaningful inspection before execution. This behavior is not necessary to provision the declared virtual environment. The Skill could instead require a separately installed `uv` binary or use a pinned and verified release artifact. ### Attack Path 1. A user runs `bash install.sh` on a system where `uv` is not installed. 2. `brew install uv` fails, or Homebrew is unavailable or unsuitable. 3. The fallback downloads the current response from `astral.sh`. 4. The remote endpoint, hosting infrastructure, DNS/TLS trust path, or upstream installer is compromised or serves an unexpectedly changed payload. 5. The response is passed directly to `sh` without integrity verification. 6. The payload executes with all permissions available to the user who invoked the installer. ### Impact Assessment A malicious remote payload could execute arbitrary commands with the invoking user's privileges. It could read or modify user-accessible files, steal credentials and environment data, alter shell configuration, install additional programs, or establish user-level persistence. The script does not invoke `sudo`, so no direct root privilege escalation is demonstrated. However, the ...[truncated 119 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: install.sh:23

Finding

Broad Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script executes shell code fetched directly from a remote URL using curl piped to sh if uv is missing. This gives the remote endpoint immediate code execution on the host without integrity verification, version pinning, or review, which is especially risky in an installer context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The fallback path runs downloaded shell code non-interactively and without warning the user that a remote installer will be executed. Even if the upstream source is legitimate, this removes an important trust boundary and makes compromise of the source, network, or DNS immediately dangerous.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 9)May include surrounding context.

sh

command -v uv > /dev/null 2>&1 || brew install uv || (curl -LsSf https://astral.sh/uv/install.sh | sh)

UV_PROJECT=$HOME/.uv-global
UV_ENV_FILE=${UV_PROJECT}/.env

mkdir -p ${UV_PROJECT}
cd ${UV_PROJECT}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 13)May include surrounding context.

sh

command -v uv > /dev/null 2>&1 || brew install uv || (curl -LsSf https://astral.sh/uv/install.sh | sh)

UV_PROJECT=$HOME/.uv-global
UV_ENV_FILE=${UV_PROJECT}/.env

mkdir -p ${UV_PROJECT}
cd ${UV_PROJECT}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to run shell commands, modify PATH, install software, and fetch packages over the network, yet it declares no explicit tool scope or permission boundaries. This increases the chance of over-broad execution and makes it harder for a caller or policy layer to constrain risky operations such as package installation and environment mutation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill intentionally creates and reuses a persistent shared environment at ~/.uv-global, causing packages, shims, and interpreter state to survive across tasks. This can let one task influence later ones through dependency confusion, malicious package persistence, poisoned shims, or unexpected PATH precedence if the user prepends the venv bin directory.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

# UV Global

Create and reuse a global `uv` environment at `~/.uv-global` so you can install Python dependencies for quick, ad hoc scripts without polluting the system interpreter.

Lightning-fast setup that keeps one shared virtual environment ready for temporary tasks.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The installer claims to provision a reusable Python environment, but it silently preinstalls a very broad set of unrelated packages including network, scraping, blockchain, media-download, and AI SDK tooling. This materially expands the attack surface, increases supply-chain risk, and grants powerful capabilities not necessary for the stated purpose, making the skill more dangerous than advertised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 34)May include surrounding context.

sh

UV_GLOBAL_BIN=${UV_PROJECT}/.venv/bin
cd ${UV_GLOBAL_BIN}

# create some utils scripts in this bin dir
# they will be handy if you add ~/.uv-global/.venv/bin to $PATH
cat > ./uvg <<EOF
#!/usr/bin/env bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script creates executable wrapper commands in the virtual environment's bin directory and encourages adding that directory to PATH, but does not clearly warn that new PATH-visible commands are being installed. This can surprise users, create command-shadowing risk, and establish durable execution entry points in their environment.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Fetching and executing an external script is inherently high risk because it delegates trust to a mutable remote resource at install time. In this skill's context, that capability is more dangerous because the installer already modifies the user's development environment and can chain immediately into arbitrary code execution.

Content

Scanner excerpt · install.sh (reported line 6)May include surrounding context.

sh

set -ue

# install uv if not exists
command -v uv > /dev/null 2>&1 || brew install uv || (curl -LsSf https://astral.sh/uv/install.sh | sh)

UV_PROJECT=$HOME/.uv-global
UV_ENV_FILE=${UV_PROJECT}/.env

Static analysis

No suspicious patterns detected.