Security audit
Security checks for vulnerabilities and agentic risk
The skill’s memory-search purpose is coherent, but its installer and optional background service create review-worthy supply-chain and persistence risk.
Install only after reviewing install.sh and preferably avoid the curl-to-shell path. Treat the GitHub-downloaded binaries as unverified unless you independently check release provenance or hashes. Keep auto-capture disabled until you have reviewed exactly which transcript paths it will read, and prefer one-shot or user-level operation over installing the sudo/system-wide service.
README.md:57Documentation Executes Mutable Remote Scripts Directly Through a Shell
install.sh:93Installer Executes Unverified Release Artifacts and Mutable Source Code
install.sh:96Predictable Temporary Files and Unvalidated Archive Extraction
install.sh:131Fallback CLI Concatenates Unvalidated LIMIT Values into SQL
scripts/setup-service.sh:31Optional Auto-Capture Uses a Privileged System-Wide Persistence Mechanism
The '| bash' construct turns downloaded content directly into shell commands, making the install path highly susceptible to chaining abuse and arbitrary command execution. In the context of an agent memory skill, compromise at install time could grant attacker-controlled persistence, data access, and tampering with future memory capture behavior.
clawdhub install chaos-memory
# Via curl
curl -fsSL https://raw.githubusercontent.com/hargabyte/Chaos-mind/main/install.sh | bash
# Manual
git clone https://github.com/hargabyte/Chaos-mind ~/.chaos/chaos-memory
The | bash chain removes the review boundary between retrieval and execution, making it easier for malicious or tampered content to run unnoticed. In a README for a skill intended for AI-agent users, this is especially risky because readers may copy-paste commands without scrutiny.
curl -fsSL https://raw.githubusercontent.com/hargabyte/Chaos-mind/main/install.sh | bash
This command executes a remote installer script from ollama.com directly in the shell, which is a high-risk software supply chain pattern. If the host, DNS, TLS termination, or script publisher is compromised, users can be tricked into running arbitrary code immediately.
3. Install dependencies:
# Install Ollama (if not already)
curl -fsSL https://ollama.com/install.sh | sh
# Pull the model
ollama pull qwen3:1.7b
The | sh pattern is a direct command-chaining abuse vector because it executes network-fetched content without validation or user review. Given this is presented as a normal dependency installation step, it normalizes a dangerous practice that can lead to full host compromise.
3. Install dependencies:
# Install Ollama (if not already)
curl -fsSL https://ollama.com/install.sh | sh
# Pull the model
ollama pull qwen3:1.7b
Piping curl output into bash is a classic dangerous command chain because it collapses download and execution into one step with no opportunity for inspection. Any compromise of the remote content immediately becomes arbitrary code execution on the user's machine.
curl -fsSL https://raw.githubusercontent.com/hargabyte/Chaos-mind/main/install.sh | bash
The test instructions include a destructive removal command but do not warn that local CHAOS state, configuration, or stored memory data will be deleted. Users may execute the step during validation and permanently lose data they did not realize was in scope.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Test fresh install
rm -rf ~/.chaos
curl -fsSL https://raw.githubusercontent.com/hargabyte/Chaos-mind/main/install.sh | bash
# Expected output:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Test fresh install
rm -rf ~/.chaos
curl -fsSL https://raw.githubusercontent.com/hargabyte/Chaos-mind/main/install.sh | bash
# Expected output:
The same unsafe command chaining is repeated in the test section, where users are likely to copy-paste it during validation. This increases the likelihood of arbitrary code execution from a compromised remote script and reinforces insecure operational practice.
# Test fresh install
rm -rf ~/.chaos
curl -fsSL https://raw.githubusercontent.com/hargabyte/Chaos-mind/main/install.sh | bash
# Expected output:
# ✓ Dolt installed
Piping remote content directly into bash is a classic command-chaining hazard because it removes inspection boundaries and executes whatever is returned immediately. In the context of installation instructions for a skill that also installs binaries and services, this significantly increases the chance of full local compromise if the upstream source is tampered with.
clawdhub install chaos-memory
# OR
curl -fsSL https://raw.githubusercontent.com/hargabyte/chaos-memory/main/skill/install.sh | bash
# Script does:
1. Install Dolt (if needed)
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
**No Automatic Remote Script Execution:**
- Install script (`install.sh`) **requires Dolt pre-installed**
- Does NOT automatically run `curl | bash` for dependencies
- Users must install Dolt via their package manager:
- macOS: `brew install dolt`
- Linux: `brew install dolt` or apt/yum
The skill markets itself as manual memory storage with auto-capture disabled by default, but the analysis indicates the install path sets up a persistent systemd service and background auto-capture behavior requiring writes to /etc/systemd/system via sudo. This is dangerous because it creates long-lived privileged execution that contradicts the user-facing description, undermining informed consent and potentially enabling continuous collection of session data.
The metadata describes automatic capture from session transcripts without a prominent privacy warning explaining that conversational data may be stored locally and processed for memory extraction. Because this skill is specifically designed to ingest team memories, missing disclosure materially increases the risk of silent collection of sensitive business, personal, or secret information.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo "Downloading binaries for $PLATFORM..."
if curl -fsSL "$DOWNLOAD_URL" -o "/tmp/chaos-memory.tar.gz" 2>/dev/null; then
tar -xzf /tmp/chaos-memory.tar.gz -C "$CHAOS_HOME/bin/"
rm /tmp/chaos-memory.tar.gz
success "Binaries downloaded"
else
warn "Could not download pre-built binaries from release"
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
if curl -fsSL "$SKILL_URL" -o "/tmp/chaos-skill.tar.gz" 2>/dev/null; then
tar -xzf /tmp/chaos-skill.tar.gz -C "/tmp/"
cp /tmp/chaos-memory-skill/scripts/chaos-cli "$CHAOS_HOME/bin/" 2>/dev/null || true
rm -rf /tmp/chaos-skill.tar.gz /tmp/chaos-memory-skill
fi
# Make sure chaos-cli exists (create if not downloaded)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
if curl -fsSL "$SKILL_URL" -o "/tmp/chaos-skill.tar.gz" 2>/dev/null; then
tar -xzf /tmp/chaos-skill.tar.gz -C "/tmp/"
cp /tmp/chaos-memory-skill/scripts/chaos-cli "$CHAOS_HOME/bin/" 2>/dev/null || true
rm -rf /tmp/chaos-skill.tar.gz /tmp/chaos-memory-skill
fi
# Make sure chaos-cli exists (create if not downloaded)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
if curl -fsSL "$SKILL_URL" -o "/tmp/chaos-skill.tar.gz" 2>/dev/null; then
tar -xzf /tmp/chaos-skill.tar.gz -C "/tmp/"
cp /tmp/chaos-memory-skill/scripts/chaos-cli "$CHAOS_HOME/bin/" 2>/dev/null || true
rm -rf /tmp/chaos-skill.tar.gz /tmp/chaos-memory-skill
fi
# Make sure chaos-cli exists (create if not downloaded)
The checklist defines broad default auto-capture glob patterns for agent session files and memory directories without any warning that these sources may contain sensitive prompts, credentials, personal data, or other confidential context. In a memory/search skill, silently normalizing continuous ingestion of such files increases the chance of overcollection and unintended persistence of private data.
The service setup instructions tell users to install and start a background consolidator service but do not warn that it will continuously monitor configured paths and persist extracted content over time. That omission is security-relevant because a long-running service materially expands data collection duration and scope compared with a one-shot command, especially for agent session logs and memory files.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
./setup-service.sh
# Start
sudo systemctl start chaos-consolidator
# Monitor
sudo journalctl -u chaos-consolidator -f
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
./setup-service.sh
# Start
sudo systemctl start chaos-consolidator
# Monitor
sudo journalctl -u chaos-consolidator -f
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
./setup-service.sh
# Start
sudo systemctl start chaos-consolidator
# Monitor
sudo journalctl -u chaos-consolidator -f
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
./setup-service.sh
# Start
sudo systemctl start chaos-consolidator
# Monitor
sudo journalctl -u chaos-consolidator -f
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
./setup-service.sh
# Start
sudo systemctl start chaos-consolidator
# Monitor
sudo journalctl -u chaos-consolidator -f
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
./setup-service.sh
# Start
sudo systemctl start chaos-consolidator
# Monitor
sudo journalctl -u chaos-consolidator -f
No suspicious patterns detected.