ClawHub
Back to skill

Security audit

RobotX Deploy CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for RobotX deployments, but its install instructions tell users to execute unverified remote shell scripts from a mutable GitHub branch.

Review the installer source before use, prefer a pinned release or verified checksum/signature instead of curl-to-bash, and avoid running setup in an environment with sensitive credentials unless you trust the RobotX CLI source. If you install it, scope and rotate the RobotX API key and protect ~/.robotx.yaml with restrictive permissions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unverified Remote Binary Installer Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

markdown
- Install (binary-first, no Go required):
  - `curl -fsSL https://raw.githubusercontent.com/haibingtown/robotx_cli/main/scripts/install.sh | bash`

Technical Analysis

The installation instructions retrieve install.sh from the mutable main branch of an external GitHub repository and stream the response directly into Bash. The payload is therefore executed before a user or agent can inspect it.

The command does not pin the script to an immutable commit or release, validate a cryptographic checksum, or verify a digital signature. Consequently, the effective payload can change after the Skill has been reviewed. Compromise of the repository, its maintainer account, or the delivery path could cause arbitrary shell commands to be executed.

Installing the declared CLI is necessary for the Skill's functionality, but unrestricted remote shell execution is not the minimum privilege required. A pinned and integrity-verified release artifact would provide the required functionality with less supply-chain exposure.

Attack Path

  1. A user or agent follows the documented quick-start installation procedure.
  2. curl retrieves the current contents of install.sh from the repository's mutable main branch.
  3. The response is streamed directly to Bash without local review or integrity verification.
  4. Bash executes all commands supplied by the remote response with the permissions of the invoking user.
  5. If the upstream source has been maliciously modified or compromised, the payload can access local data, alter files, retrieve additional payloads, or abuse available credentials.

Impact Assessment

A malicious remote installer would obtain arbitrary command execution under the invoking user's account. Its accessible scope could include us ...[truncated 440 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation instruction.
  • Pin installation artifacts to an immutable, reviewed release version or commit rather than main.
  • Publish a cryptographic checksum or signature through a separately protected channel and verify it before execution.
  • Download the installer to a local file first, permit inspection, and require explicit user approval before running it.
  • Prefer a signed package-manager release or a versioned binary archive installed into a user-scoped directory.
  • Run installation with ordinary user privileges and avoid requesting elevated privileges unless a specific operation demonstrably requires them.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:19
Finding

Unverified Remote Go Installation Script Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

markdown
- Fallback install (if you explicitly want source install):
  - `go install github.com/haibingtown/robotx_cli/cmd/robotx@latest`
  - Or auto PATH setup: `curl -fsSL https://raw.githubusercontent.com/haibingtown/robotx_cli/main/scripts/go-install.sh | bash`

Technical Analysis

The fallback instructions stream go-install.sh from an external repository's mutable main branch directly into Bash. No immutable revision, checksum, or signature is supplied. The remote party can therefore change the executed behavior after this Skill has been installed or audited.

The instruction is described as automatic PATH setup, but piping an unrestricted remote shell script into Bash grants substantially broader capability than PATH configuration requires. The script could perform any operation available to the current user, and the local Skill contains no implementation that constrains or verifies its behavior.

The adjacent source-install command also uses the mutable @latest selector. Although no malicious dependency content was established during this audit, pinning an explicitly reviewed version would reduce similar supply-chain uncertainty.

Attack Path

  1. A user or agent selects the documented fallback installation procedure.
  2. curl downloads the current go-install.sh response from the mutable main branch.
  3. The response is passed directly to Bash without inspection or cryptographic verification.
  4. The remote script executes with the invoking user's ambient filesystem, environment, and network permissions.
  5. A compromised or malicious upstream script can perform operations unrelated to PATH setup, including modifying shell configuration, reading credentials, or installing additional executable content.

Impact Assessment

S ...[truncated 561 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash command.
  • Document manual, narrowly scoped PATH configuration instead of executing a general-purpose remote script.
  • If an installer remains necessary, pin it to an immutable reviewed revision and verify a cryptographic checksum or signature before execution.
  • Download the script to disk for inspection and require explicit approval before running it.
  • Replace go install ...@latest with a specific reviewed release version.
  • Ensure any PATH changes are limited to the user's configuration, are clearly disclosed, and do not replace or shadow unrelated system tools.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to pipe remote content from GitHub directly into bash, which executes whatever is served at that URL without prior inspection or integrity verification. Because this is a deployment skill likely used in privileged developer or CI environments, a compromised repository, maintainer account, branch, or network path could lead to arbitrary code execution and credential theft.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill recommends storing an API key in ~/.robotx.yaml, creating persistent local credentials on disk. If file permissions are weak, the host is shared, backups are exposed, or other processes/users can read the file, the token could be reused to access or deploy RobotX applications.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

  1. Fallback (only if login is not possible or fails): manual API key setup via console and configure locally.
    • export ROBOTX_BASE_URL=https://your-robotx-server.com
    • export ROBOTX_API_KEY=your-api-key
    • Or write ~/.robotx.yaml:
yaml
base_url: https://your-robotx-server.com

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

This command fetches an external script from a live GitHub URL and immediately executes it with bash. That creates a direct remote code execution path if the upstream content changes maliciously or is tampered with, and the risk is amplified because installation often happens with developer privileges and access to deployment secrets.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
- Check CLI availability: `which robotx || which robotx_cli`
- Install (binary-first, no Go required):
  - `curl -fsSL https://raw.githubusercontent.com/haibingtown/robotx_cli/main/scripts/install.sh | bash`
- Fallback install (if you explicitly want source install):
  - `go install github.com/haibingtown/robotx_cli/cmd/robotx@latest`
  - Or auto PATH setup: `curl -fsSL https://raw.githubusercontent.com/haibingtown/robotx_cli/main/scripts/go-install.sh | bash`

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

This fallback instruction repeats the same unsafe pattern of downloading and executing a remote shell script in one step. Even though it is framed as optional PATH setup, it still gives arbitrary code execution to unverified remote content and may run in environments containing source code, SSH keys, or API credentials.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
- `curl -fsSL https://raw.githubusercontent.com/haibingtown/robotx_cli/main/scripts/install.sh | bash`
- Fallback install (if you explicitly want source install):
  - `go install github.com/haibingtown/robotx_cli/cmd/robotx@latest`
  - Or auto PATH setup: `curl -fsSL https://raw.githubusercontent.com/haibingtown/robotx_cli/main/scripts/go-install.sh | bash`

## Configure

Static analysis

No suspicious patterns detected.