T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:90- Finding
Unpinned Remote Script Is Executed Directly by the Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Comic Guide Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill’s comic-generation behavior is mostly coherent, but its recommended installer can run mutable remote code and persist files into multiple agent skill directories.
Install only through ClawHub or a reviewed, pinned manual copy path. Avoid the README’s curl | bash installer and do not let an agent auto-install it unattended. Review any generated prompts before sending proprietary code, private documents, secrets, or licensed character/style requests to external image-generation services.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install.sh:4- Finding
Installer Retrieves Unpinned Skill Instructions from a Mutable Upstream Branch
- Content
View full analysis
/dev/null ``` The fallback paths stream an unverified archive directly into `tar`: ```bash curl -sL "$REPO_URL/archive/refs/heads/main.tar.gz" | tar xz -C "$tmp_dir" mv "$tmp_dir"/comic-guide-skill-main "$tmp_dir/repo" ``` ```bash wget -qO- "$REPO_URL/archive/refs/heads/main.tar.gz" | tar xz -C "$tmp_dir" mv "$tmp_dir"/comic-guide-skill-main "$tmp_dir/repo" ``` The downloaded instructions are then copied into a trusted agent Skill directory: ```bash cp "$tmp_dir/repo/SKILL.md" "$dest/" [ -d "$tmp_dir/repo/references" ] && cp -r "$tmp_dir/repo/references" "$dest/" [ -d "$tmp_dir/repo/examples" ] && cp -r "$tmp_dir/repo/examples" "$dest/" ``` ### Technical Analysis The installer does not install the files from the locally reviewed package. Instead, it downloads the latest upstream repository state at installation time. Neither the Git clone nor the archive fallback is pinned to an immutable commit, and no checksum or signature is verified. The downloaded `SKILL.md`, reference prompts, and examples are installed under one or more trusted agent locations: - `~/.cursor/skills/comic-guide` - `~/.claude/skills/comic-guide` - `~/.openclaw/skills/comic-guide` These files can influence future AI agent behavior when the Skill is loaded. Consequently, an upstream compromise could replace the benign audited instructions with prompt-hijacking content, instructions to invoke dangerous tools, or directives to disclose sensitive information. The archive fallbacks also decomp ...[truncated 2423 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (30)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The
| bashchain is itself a dangerous execution sink because it converts downloaded network content directly into shell commands. In a skill README this is more dangerous than a generic scripting example because installation instructions are likely to be trusted and executed verbatim by both users and automation agents.- Content
自动检测你安装了哪些平台（Cursor / Claude Code / OpenClaw），安装到正确位置：
bash curl -sL https://raw.githubusercontent.com/bcefghj/comic-guide-skill/main/scripts/install.sh | bash指定平台：
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
Although abbreviated with ellipses, this instruction still documents the pattern of piping remote content to
bashwith arguments, which normalizes unsafe installation behavior. The danger is unchanged: whatever content is fetched can execute with the user's privileges and alter local configuration or implant persistence.- Content
bash # 只安装到 Cursor curl -sL ... | bash -s -- --cursor # 只安装到 Claude Code curl -sL ... | bash -s -- --claude
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
This line repeats the unsafe remote-script execution pattern for another installation mode, reinforcing a dangerous operational practice. Multiple variants increase exposure because users may copy whichever example matches their platform without noticing the lack of verification.
- Content
md curl -sL ... | bash -s -- --cursor # 只安装到 Claude Code curl -sL ... | bash -s -- --claude # 只安装到 OpenClaw curl -sL ... | bash -s -- --openclaw
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
This is another instance of remote script execution via shell piping, carrying the same arbitrary code execution risk as the earlier examples. In the context of a cross-platform skill installer, such commands may also write into multiple agent skill directories, amplifying the blast radius of a compromised installer.
- Content
curl -sL ... | bash -s -- --claude
只安装到 OpenClaw
curl -sL ... | bash -s -- --openclaw
text ### 方式二：ClawHub 安装（OpenClaw 用户）
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A documented skill that claims to generate comic PNGs from user content but actually installs files, probes local environment paths, or downloads remote repository content creates a dangerous trust mismatch. Users may provide sensitive documents expecting local content transformation, while the real behavior could modify the host, fetch unreviewed code, or exfiltrate data to external services without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation guidance is very broad: users can invoke the skill on essentially "any document/source code/technical knowledge" with a casual phrase. That increases the chance the skill is applied outside a clearly bounded use case, including on sensitive code, proprietary documents, or risky content without explicit confirmation or guardrails. In this context, the skill generates transformed outputs rather than directly executing code, which makes it less severe than an execution-capable skill, but the scope ambiguity is still a real security and privacy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README explicitly recommends executing a remotely fetched script via
curl ... | bash, which allows arbitrary code from the remote source to run immediately on the user's machine without inspection, pinning, or integrity verification. In a skill-installation context this is especially risky because users are being encouraged to grant filesystem and shell execution implicitly during setup.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README tells users to ask an AI to install the skill automatically from GitHub, but does not warn that this may cause code execution, shell commands, network fetches, or filesystem modifications. This increases the chance that users delegate sensitive installation actions without understanding what the agent will do or verifying the fetched content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The parameter table sets
--langdefault tozh, and elsewhere the README emphasizes Chinese text embedded in images. This can be a language/locale policy issue because the skill appears to force a specific language by default rather than clearly asking the user to choose.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation guidance uses broad phrases like creating comics or illustrated guides from almost any content, which can cause the skill to trigger in ordinary conversations beyond clear user intent. Over-broad auto-invocation increases the chance that sensitive source material is processed or sent to downstream tools unexpectedly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The template states 'All text in Chinese,' which imposes a fixed language requirement in natural language. Although the file documents a '--lang' option elsewhere, this instruction contradicts user language choice and can violate language/locale policy by forcing Chinese output without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow explicitly routes prompts to external image-generation mechanisms, but the skill description does not warn users that source content, derived prompts, or embedded technical details may be transmitted to third-party tools or services. This can expose proprietary code, internal documentation, or secrets if users assume all processing remains local.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The character sheet explicitly instructs use of recognizable copyrighted franchise characters and styles such as Doraemon and Nobita, which creates IP infringement and policy-compliance risk when the skill generates derivative commercial-style outputs. In this skill context, the risk is increased because the file is not merely discussing those characters academically; it operationalizes them as generation targets for produced images.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L21 explicitly requires all text to be in Simplified Chinese. This is a natural-language locale restriction, and the file does not provide any user opt-in, alternative language option, or context showing that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains a natural-language instruction that forces a specific language output: "All text in Simplified Chinese." The policy for this audit flags language or locale constraints when they are imposed without user opt-in or an explicit justified regional scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains a natural-language instruction mandating a specific language: "All text in Simplified Chinese." The policy allows locale or language constraints only when the user is given a choice or when the restriction is clearly documented and justified as region-specific, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file includes a natural-language instruction that all generated text must be in Simplified Chinese. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation, and the document does not present this as an optional or region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example prompt reinforces a mandatory Chinese-only output requirement rather than presenting it as a configurable option. Because this is natural-language guidance in the skill file, it constitutes the same language-policy issue and may cause downstream prompts to always constrain users to one locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file states that all image prompts should append "speech bubbles with text in Chinese characters," making Chinese the required output language for every style. This is a natural-language locale constraint presented as a universal rule, and the document does not provide any user choice or justification for enforcing that language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script automatically downloads remote content and writes into one or more local AI client skill directories without an explicit confirmation step or dry-run warning. While expected for an installer, silent modification of multiple tool directories increases the chance of unintended installation, especially when the script defaults to installing everywhere it detects.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a skill for generating comic-style educational guides, but this script downloads code from GitHub and installs files into Cursor, Claude, and OpenClaw skill directories. That is packaging/installation behavior rather than comic generation, and access to multiple local application directories is not part of the stated end-user purpose.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh wget -qO- "$REPO_URL/archive/refs/heads/main.tar.gz" | tar xz -C "$tmp_dir" mv "$tmp_dir"/comic-guide-skill-main "$tmp_dir/repo" else err "需要 git、curl 或 wget 之一，请先安装" exit 1 fi
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file presents the skill description and invocation instructions only in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and justified. This can constitute a language/locale policy issue because it implicitly enforces a specific language without opt-in.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
This line fetches a script from GitHub and pipes it directly into
bash, creating a classic remote code execution pathway with no opportunity for audit before execution. If the repository, branch, network path, or hosting account is compromised, users will execute attacker-controlled shell code immediately.- Content
自动检测你安装了哪些平台（Cursor / Claude Code / OpenClaw），安装到正确位置：
bash curl -sL https://raw.githubusercontent.com/bcefghj/comic-guide-skill/main/scripts/install.sh | bash指定平台：
Static analysis
No suspicious patterns detected.