ClawHub
Back to skill

Security audit

Qveris

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it brokers broad third-party API execution and includes risky remote installer commands without enough privacy or supply-chain guardrails.

Review this skill before installing. It is intended to send search queries and execution parameters to QVeris and to call tools discovered there, so avoid using it with secrets, regulated data, or actions that could mutate accounts unless you explicitly trust QVeris and the downstream tools. Prefer safer uv installation methods over the documented pipe-to-shell commands, or verify installer integrity before running them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:18
Finding

Unverified Remote Installer Is Downloaded and Executed Directly in the English Installation Guide

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 18-27
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown
**macOS and Linux:**
```bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

powershell
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
text

### Technical Analysis

The installation instructions download mutable content from an external URL and immediately pass it to a command interpreter. The Unix command pipes the HTTP response directly into `sh`, while the Windows command uses `Invoke-RestMethod` and `Invoke-Expression` with the execution policy bypassed.

No version is pinned, and the instructions do not require a checksum, cryptographic signature, local inspection, or separation between download and execution. Consequently, the code executed by users can change after this repository has been reviewed. The repository contents alone cannot establish the ongoing integrity of the remote scripts.

Although installing `uv` supports the documented workflow, immediate remote-to-shell execution is not necessary for the Skill's functionality and does not follow least-privilege or supply-chain hardening principles.

### Attack Path

1. A user follows the installation instructions in `README.md`.
2. The shell or PowerShell client retrieves the current response from the external installer URL.
3. An attacker compromises the hosting account, distribution infrastructure, DNS/TLS path, or another component capable of controlling the returned content.
4. The attacker substitutes or modifies the installer response with arbitrary commands.
5. The pipeline executes those commands immediately, without giving the user an opportunity to inspect or verify the payload.
6. The malicious payload operates with the privileges of the user who launched the command.

### Impact Assessment

Suc
...[truncated 780 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | sh and irm | iex installation methods from the primary setup instructions.
  2. Prefer a trusted operating-system package manager with a pinned or constrained version where available.
  3. If a standalone installer is required:
    • Link to a specific, immutable release artifact.
    • Download it to a local file without executing it.
    • Verify a published cryptographic checksum or signature.
    • Allow the user to inspect the downloaded script.
    • Execute it only after successful verification.
  4. Do not recommend bypassing PowerShell execution policy.
  5. Document that installation should occur as an unprivileged user and should not use sudo, root, or an elevated PowerShell session unless strictly required.
  6. Maintain a lockfile and integrity controls for the Python dependencies subsequently installed by uv.

T03 · Remote Payload Retrieval and Execution

Error
Location
README.zh-CN.md:18
Finding

Unverified Remote Installer Is Downloaded and Executed Directly in the Chinese Installation Guide

Content
View full analysis

Vulnerability Details

File Location: README.zh-CN.md, lines 18-27
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown
**macOS and Linux:**
```bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

powershell
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
text

### Technical Analysis

The localized installation guide instructs users to retrieve mutable scripts from an external host and execute the responses immediately. On macOS and Linux, the downloaded response is piped directly to `sh`. On Windows, the response is evaluated with `Invoke-Expression`, and PowerShell's execution policy is explicitly bypassed.

The commands provide no release pinning, checksum verification, signature validation, or review step. The effective installer payload can therefore change independently of the audited repository. Trust in the current domain does not eliminate the risk created by future compromise of the hosting or delivery chain.

Installing a Python package manager is a prerequisite rather than part of the Skill's core tool-search functionality. Direct execution of unverified network content exceeds the minimum behavior needed to install that prerequisite safely.

### Attack Path

1. A user follows the localized setup instructions in `README.zh-CN.md`.
2. `curl` or PowerShell requests the remote installer.
3. An attacker gains control over the installer response through compromise of the host, publishing account, network delivery chain, or another trusted infrastructure component.
4. The attacker returns a modified script containing arbitrary commands.
5. `sh` or `Invoke-Expression` executes the response immediately.
6. The attacker obtains command execution under the user's current security context.

### Impact Assessment

Exploitation can grant an attacker all privileges available to the
...[truncated 564 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove direct remote-to-shell execution instructions from the localized documentation.
  2. Keep the security posture of all localized documentation consistent with the English guide.
  3. Recommend a trusted native package manager or an immutable, versioned release artifact.
  4. Require users to download installers separately, verify an official checksum or signature, and inspect them before execution.
  5. Replace the PowerShell execution-policy bypass and Invoke-Expression pattern with a verified local installation process.
  6. Explicitly advise users to install under the minimum required privileges and avoid administrator or root execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The curl ... | sh pattern is a direct arbitrary code execution primitive: it streams remote content straight into the shell without review. In the context of a skill that users install locally, this increases danger because any compromise of the remote installer path can immediately lead to full host compromise during setup.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

macOS and Linux:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping curl output directly into 'sh' removes any review boundary and enables immediate execution of attacker-controlled content if the fetched script is altered. In a skill README, this is especially risky because users may follow setup instructions verbatim, turning documentation into a code-execution vector.

Content

Scanner excerpt · README.zh-CN.md (reported line 21)May include surrounding context.

macOS 和 Linux:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is configured with broad stock/trading/analysis trigger terms and auto_invoke: true, making it likely to activate on routine conversation that merely mentions finance-related topics. Because the skill performs dynamic external tool discovery and execution, unintended invocation can cause user prompts or derived data to be sent to third-party services and can trigger external actions without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly promotes dynamic search and execution of external tools through a third-party API, but it does not warn users that prompts, parameters, or other sensitive inputs may be transmitted off-platform. In an agent skill context, this omission is security-relevant because users may unknowingly expose confidential data to an untrusted external service during tool discovery or execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises dynamic API search and execution but does not warn users that their prompts, parameters, or other data may be sent to an external service. Because this skill is specifically designed to search and invoke third-party APIs, missing disclosure materially increases privacy and consent risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README describes very broad automatic trigger conditions such as weather, stocks, search, currency, and 'more', which can cause the skill to activate on many normal user queries. In this skill's context, activation leads to dynamic discovery and execution of external tools via the QVeris API, increasing the chance of unintended external calls and data exposure without clear user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises dynamic discovery and execution of external APIs but does not clearly warn that user-provided queries, parameters, or derived context may be transmitted to third-party services. In this context, the omission is meaningful because the skill is designed to broker requests to unknown external tools, increasing privacy, compliance, and consent risks if users are not explicitly informed.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The installation instructions tell users to fetch and immediately execute a remote shell script from the internet. While common for developer tooling, this pattern is risky because compromise of the hosting site, transport, or script supply chain would result in arbitrary code execution on the user's machine.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

macOS and Linux:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

L03 标注“中文文档 | English”，而当前文件整体内容仅以中文呈现，没有在文档内说明语言选择机制或适用受众。按语言/地区政策，若面向广泛用户，强制单一语言版本而无显式选择说明可能构成语言可用性问题。

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The installation instructions tell users to fetch and execute a remote shell script directly from the network. This creates a supply-chain risk: if the remote host, transport, or script distribution path is compromised, arbitrary code will run immediately on the user's machine.

Content

Scanner excerpt · README.zh-CN.md (reported line 21)May include surrounding context.

macOS 和 Linux:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The dependency specification uses a broad lower-bound only (httpx>=0.25.0) rather than pinning or constraining to a vetted safe range, so builds may resolve to different versions over time and the manifest alone does not prove that vulnerable releases are excluded. This creates supply-chain uncertainty and can allow installation of a package version with known security issues if dependency resolution or environment constraints select an unsafe release.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.