Security audit

resolved-sh-rstack

Security checks for vulnerabilities and agentic risk

Overview

The skill suite is mostly purpose-aligned, but it can generate or run live account-changing shell commands and has weak install, input, and secret-handling controls.

Install only after reviewing the exact source version. Prefer a pinned CLI version and immutable commit, avoid global auto-confirmed installation, use a least-privilege resolved.sh API key, and review every generated curl command before running it. Do not use untrusted values in the generated shell snippets without JSON-safe serialization, and avoid printing or storing webhook secrets in shared temp files or logs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: rstack-content/SKILL.md:289
Finding: Shell Command Injection Through Unvalidated Ask-Inbox Email
Content: View full analysis
Remediation: View remediation
/tmp/rstack_ask_payload.json <<'PY' import json import sys from decimal import Decimal, InvalidOperation email = sys.argv[1] try: price = Decimal(sys.argv[2]) except InvalidOperation: raise SystemExit("Invalid price") if price < Decimal("0.50"): raise SystemExit("Price must be at least 0.50 USDC") print(json.dumps({ "ask_email": email, "ask_price_usdc": float(price), })) PY curl --fail-with-body -X PUT \ "https://resolved.sh/listing/$RESOLVED_SH_RESOURCE_ID/ask" \ -H "Authorization: Bearer $RESOLVED_SH_API_KEY" \ -H "Content-Type: application/json" \ --data-binary @/tmp/rstack_ask_payload.json ``` 5. Prefer passing user-controlled values as program arguments or environment values rather than embedding them in generated shell source. 6. Apply the same safe serialization pattern to titles, descriptions, Markdown content, slugs, URLs, and other user-derived fields throughout the suite. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: rstack-services/SKILL.md:139
Finding: Webhook Secret Disclosed Through Predictable Temporary Storage and Terminal Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:20
Finding: Unpinned npx Package Execution and Installation from a Mutable Repository
Content: View full analysis
Remediation: View remediation
add ... ``` 2. Pin the repository to an immutable commit SHA or a cryptographically signed release rather than the default branch. 3. Publish and verify integrity hashes or signatures for release artifacts. 4. Avoid global installation by default. Use project-local installation unless global scope is explicitly required. 5. Remove automatic confirmation where practical so users can review the package, version, source, and requested installation scope. 6. Document the exact tested CLI version and repository commit. 7. Recommend running installation without elevated privileges and in an isolated environment. 8. Add automated dependency review, lockfile verification, provenance attestations, and release-signature checks to the publishing process. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (36)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · rstack-content/SKILL.md (reported line 73)May include surrounding context.
md
print(f'Published posts: {len([p for p in posts if p.get(\"price_usdc\", 0) == 0])} free, {len([p for p in posts if (p.get(\"price_usdc\") or 0) > 0])} paid') print(f'Published courses: {len(courses)}') has_paywall = '<!-- paywall' in md print('Page paywall: ', 'yes' if has_paywall else 'no') print(f'md_content length: {len(md)} chars') " 2>/dev/null || echo "(Could not parse content state)"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · rstack-content/SKILL.md (reported line 165)May include surrounding context.
md
Generate all PUT commands in sequence. Show them together so the operator can run them in order. After generating commands: "Posts at `GET https://{subdomain}.resolved.sh/posts`. Buyers pay per post via x402 USDC on Base and receive a 30-day access token for re-reads." ---

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · rstack-data/SKILL.md (reported line 41)May include surrounding context.
bash
# Fetch current data files curl -sf "https://resolved.sh/listing/$RESOLVED_SH_RESOURCE_ID/data" \ -H "Authorization: Bearer $RESOLVED_SH_API_KEY" \ -o /tmp/rstack_files.json

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README advertises skills that generate curl, PATCH, PUT, and service-registration commands using live API credentials, but it does not clearly warn that these actions can modify production account data, publish paid endpoints, or change monetized content. Users may execute generated commands with insufficient review, increasing the risk of accidental misconfiguration, unintended publication, or exposure of business-critical settings.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version or commit, which can cause users to fetch and execute whatever version is current at install time. If the upstream package or dependency chain is compromised, users may unknowingly install malicious code or altered skill behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This install example again uses unpinned npx skills, creating a supply-chain risk because users will execute the latest published package version at runtime. In a skill ecosystem that can emit operational commands, compromise of the installer path could directly affect developer environments or downstream generated artifacts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This command repeats the same pattern of invoking npx skills without a fixed version, exposing users to mutable upstream package contents. Because installation is performed from a remote GitHub source and mediated by an unpinned tool, both package and dependency changes can alter what is installed over time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README provides another unpinned npx skills install command, which means users execute an unaudited current version rather than a reviewed, stable release. That creates avoidable supply-chain exposure and undermines reproducibility for a tool that can influence agent behavior and operational workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This installation example remains vulnerable to package drift and package compromise because npx skills is not version-pinned. The risk is especially relevant here because the skill suite is designed to generate commands affecting external services and account configuration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: By using npx skills without pinning, this command causes users to trust a mutable package resolution path at execution time. A compromised or malicious package update could lead to arbitrary code execution during installation or silently altered installed skills.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This final install example duplicates the same supply-chain weakness: an unpinned npx execution path for a remote tooling package. Repetition across all documented install methods increases the chance that users will adopt an unsafe default and makes the issue systemic rather than incidental.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill instructs operators to set RESOLVED_SH_API_KEY as an environment variable but provides no guidance on secure handling, storage, rotation, or avoiding accidental exposure in shell history, logs, screenshots, or committed config files. In a skill focused on publishing, distribution, and API monetization, users are likely to copy commands and artifacts broadly, which increases the chance of credential leakage and unauthorized access to the resolved.sh account or related resources.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger guidance encourages broad, proactive invocation after registrations or other skill runs, which can cause the audit to execute without a tightly scoped user request. In this skill context, that matters because the audit performs network requests and may use optional credentials, increasing the chance of unintended data access or surprise external calls.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest states the API key is needed only for data and services checks, but the implementation also uses it to query Ask inbox configuration. This mismatch is risky because users may provide credentials under a narrower trust assumption than the skill actually exercises, enabling unintended access to monetization or account configuration data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill claims to fetch only public surfaces, but it conditionally accesses an authenticated Ask inbox endpoint using operator credentials. This is dangerous because it expands the data-access scope beyond what the description promises, which can undermine user consent and cause the agent to retrieve non-public account information during a routine audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Broad trigger phrases increase the chance the skill is invoked in situations where the user did not intend to perform live content monetization changes. In this skill, invocation can lead to generation or execution of authenticated PUT commands against production resources, so accidental activation materially raises risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill lacks an upfront warning that it can create or modify live paid content, paywalls, courses, and inbox monetization using authenticated API requests. Without that disclosure, operators may provide inputs assuming advisory-only behavior, while the skill is actually capable of producing production-changing commands.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description at L006-L012 limits the skill's scope to monetized content publishing on resolved.sh: blog posts, courses, and paywalled page sections. Phase 1 introduces an additional capability, 'Ask inbox', which is a paid messaging/service endpoint rather than content publishing, expanding behavior beyond the described scope.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This skill generates authenticated external PUT requests that transmit user-supplied content and monetization settings to a remote service. In context this is the intended product behavior, but it still represents a real security-sensitive action because malformed prompts, accidental invocation, or unreviewed placeholders could publish or overwrite live content.
Content: Scanner excerpt · rstack-content/SKILL.md (reported line 119)May include surrounding context.
bash
# Post: "{title}" curl -X PUT "https://resolved.sh/listing/$RESOLVED_SH_RESOURCE_ID/posts/{slug}" \ -H "Authorization: Bearer $RESOLVED_SH_API_KEY" \ -H "Content-Type: application/json" \ -d @- <<'EOF'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: This PUT request can overwrite the page's full md_content, including insertion of a paywall marker, which may change what visitors can access and monetize or hide existing content. Because it updates the root listing document, an operator mistake or adversarial prompt input could cause broader content loss or unintended paywalling than a single post update.
Content: Scanner excerpt · rstack-content/SKILL.md (reported line 267)May include surrounding context.
Generate the PUT command:

bash
curl -X PUT "https://resolved.sh/listing/$RESOLVED_SH_RESOURCE_ID" \ -H "Authorization: Bearer $RESOLVED_SH_API_KEY" \ -H "Content-Type: application/json" \ -d @- <<'EOF'

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says to use this skill when asked to "improve my dataset," "set up data sales," or similar phrases, but it does not clearly constrain scope or provide exclusion examples. These phrases are common enough to match general conversation and could cause unintended invocation outside the intended resolved.sh marketplace context.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · rstack-data/SKILL.md (reported line 71)May include surrounding context.
for f in d.get('files', []): print(f['filename']) "); do echo "=== schema: $FILENAME ===" curl -sf "https://$RESOLVED_SH_SUBDOMAIN.resolved.sh/data/$FILENAME/schema" echo done

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to generate authenticated PATCH and PUT commands that change listing metadata and page content, but it does not require an explicit warning that these are live account modifications or a confirmation gate before producing actionable commands. In an agent setting, this increases the risk of unintended administrative changes, especially if the user is casually asking for advice rather than authorizing account updates.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The listed invocation phrases such as "get discovered" and "where should I list this" are broad and can plausibly match ordinary user requests outside a tightly scoped distribution workflow. Overbroad triggers can cause unintended skill activation, leading the agent to fetch external content, ask for repository details, and generate publication artifacts in contexts where the user did not explicitly intend to run this skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.