iBus.CL CLI (API Transporte RED Chile)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.0.0

Overview

The skill is a small public-transit CLI guide, but its recommended installer runs an unaudited remote shell script from a mutable GitHub branch.

Review this skill carefully before installing. Prefer cloning the repository, inspecting the installer or using the manual pip install path in an isolated environment, and avoid running the one-line remote bash command, especially with elevated privileges.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:11

Finding

Mutable Remote Installer Is Downloaded and Executed Without Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash

bash <(curl -sSL https://raw.githubusercontent.com/iiroak/iBus.CL-API/main/install.sh)

Technical Analysis

The documented installation command retrieves a shell script from a personal GitHub repository and passes it directly to Bash through process substitution. The URL references the mutable main branch rather than a reviewed commit or immutable release. Consequently, the code executed by users can change after this Skill has been audited.

No checksum, digital signature, version pin, or manual review step is required before execution. The remote install.sh file is not included in this project, so its commands and side effects cannot be verified from the audited artifact. The -L option also follows redirects, while -s suppresses progress and some diagnostic output.

This installation mechanism exceeds the minimum privileges necessary for the declared functionality. Installing a public-transport query CLI may require downloading package files, but it does not require blindly granting an unaudited, mutable remote script all permissions held by the invoking user.

Attack Path

1. An attacker compromises the upstream GitHub account or repository, gains write access, or otherwise causes the content served for install.sh to change.
2. The attacker modifies install.sh on the referenced main branch to contain arbitrary shell commands.
3. A user follows the installation command documented in SKILL.md.
4. curl downloads the attacker-controlled script without verifying its version, checksum, or signature.
5. Bash immediately executes the payload with the permissions of the invoking user.
6. The payload can perform arbitrary actions available under that account. If the command is invoked from an elevated shell, the resulti ...[truncated 650 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct remote-to-shell installation command.
2. Distribute the CLI through a trusted package registry or an immutable, versioned release.
3. Pin installation material to a reviewed commit or release rather than the mutable main branch.
4. Publish and verify a cryptographic checksum or signature before executing or installing downloaded content.
5. Require users to download the installer as a file, inspect it, verify its integrity, and only then execute it.
6. Include the installer in the audited Skill package if it is required, so its complete behavior can be reviewed.
7. Recommend installation in a dedicated Python virtual environment under a non-privileged account.
8. Avoid sudo or administrator execution unless a clearly documented operation strictly requires it.
9. Document all filesystem, network, and configuration changes made by the installer.

A safer workflow would use an immutable release archive, verify its published hash or signature, inspect the extracted project, create a virtual environment, and run python -m pip install . without elevated privileges.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to execute a remote shell script directly with bash <(curl ...), which bypasses normal review of downloaded code and gives the script immediate code execution on the user's system. Even if the referenced repository is legitimate today, a compromised GitHub account, modified branch, or man-in-the-middle in the supply chain could turn this into arbitrary command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

All user-facing instructions and examples in the file are presented only in Spanish. If organizational policy requires avoiding forced language selection without opt-in, this may violate that policy because no alternative language or explicit locale justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.