Confluence CLI (confcli)

• Outcome: Review
• Latest audit: May 28, 2026, 9:37 AM
• Version:
  0.2.5

Overview

This Confluence helper is coherent, but it asks users or agents to run an unpinned remote installer for a tool that can change or delete workspace content.

Review before installing. Prefer installing `confcli` from a pinned release, Cargo, or a downloaded installer you inspect first, and use a Confluence token limited to the spaces and permissions you actually need. Avoid broad write/delete permissions unless those workflows are required.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

Low

• Category: Supply Chain

Content

If not installed, install via:

```bash
curl -fsSL https://raw.githubusercontent.com/hochej/confcli/main/install.sh | sh
```

To install a specific version or to a custom directory:

• Confidence: 98% confidence
• Finding: curl -fsSL https://raw.githubusercontent.com/hochej/confcli/main/install.sh | sh

Chaining Abuse

High

• Category: Tool Misuse

Content

If not installed, install via:

```bash
curl -fsSL https://raw.githubusercontent.com/hochej/confcli/main/install.sh | sh
```

To install a specific version or to a custom directory:

• Confidence: 99% confidence
• Finding: | sh

VirusTotal

66/66 vendors flagged this skill as clean.