Skill Installer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

This skill is meant to install other skills from GitHub, but it grants persistent agent-behavior authority with missing installer scripts and weakly documented validation.

Review before installing. This skill would be appropriate only if the missing scripts are supplied from a trusted, versioned source and the installer pins commits, verifies content, stages downloads for inspection, and clearly confirms the destination and persistence impact before activation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:22

Finding

Mutable Remote Skills Can Be Installed into Persistent Agent Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–40
Vulnerability Type: Remote supply-chain payload retrieval
Risk Level: High

Vulnerable Code

markdown

### Install a skill from GitHub

```bash
bash <this-skill-path>/scripts/install-skill.sh --repo owner/repo --path path/to/skill [--ref branch]

Or from a full GitHub URL:

bash

bash <this-skill-path>/scripts/install-skill.sh --url https://github.com/owner/repo/tree/main/path/to/skill

Behavior

• Downloads the skill directory from GitHub via zip archive (public repos) or falls back to git sparse-checkout (private repos).
• Validates that the downloaded directory contains a SKILL.md.
• Aborts if the destination skill directory already exists.
• Installs to .grok/skills/<skill-name> (persisted across sessions).

text

### Technical Analysis

The documented interface accepts a user-selected GitHub repository, path, URL, and optional branch reference. Branches such as `main` are mutable, so the downloaded content can change after the installer or repository was reviewed.

The only documented content validation is checking whether the downloaded directory contains a `SKILL.md`. This does not establish source authenticity or detect malicious instructions, executable scripts, symlinks, path traversal entries, or other unsafe files. No commit pinning, signature verification, expected digest, repository allowlist, or content security review is documented.

Installation into `.grok/skills/` makes the downloaded content available across sessions. While the artifact does not prove that arbitrary native code is executed during installation, a remotely controlled skill may subsequently influence agent behavior or invoke included scripts when loaded.

### Attack Path

1. An attacker prepares a GitHub repository containing a syntactically valid skill and the required `SKILL.md`.
2. The attacker persuades a use
...[truncated 1211 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict installation to explicitly approved repositories and owners.
• Resolve every branch or tag to an immutable commit SHA and show that SHA to the user before installation.
• Verify a trusted signature or an independently obtained expected digest for downloaded content.
• Stage downloads outside the active skills directory and inspect the complete file tree before activation.
• Reject absolute paths, .. traversal, unsafe archive entries, device files, and symlinks that escape the staging or destination directory.
• Audit SKILL.md and every executable file for dangerous instructions, shell execution, credential access, and unexpected network behavior.
• Require explicit confirmation that identifies the repository, path, resolved commit, destination, and detected executable files.
• Apply least privilege and prevent installed skills from automatically receiving secrets or unrestricted tools.
• Use an atomic installation process and record provenance metadata for later review and removal.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:10

Finding

Security-Critical Installer Scripts Are Missing from the Audited Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–24
Vulnerability Type: Incomplete and unverifiable security-critical implementation
Risk Level: Medium

Vulnerable Code

markdown

## Scripts

All scripts require network access. Use the bash tool to run them.

### List available skills from a GitHub repo

```bash
bash <this-skill-path>/scripts/list-skills.sh [--repo owner/repo] [--path skills-dir] [--ref branch]

Defaults: --repo xai-org/skills --path skills/.curated --ref main

Install a skill from GitHub

bash

bash <this-skill-path>/scripts/install-skill.sh --repo owner/repo --path path/to/skill [--ref branch]

Or from a full GitHub URL:

text

### Technical Analysis

The package contains only `SKILL.md`, but it directs the agent to execute `scripts/list-skills.sh` and `scripts/install-skill.sh`. Neither referenced script is present in the audited project.

Consequently, none of the claimed behavior can be verified against an implementation. Security-sensitive properties that remain unauditable include argument handling, shell quoting, URL validation, token handling, archive extraction, sparse-checkout behavior, destination containment, symlink handling, overwrite protection, and cleanup of temporary files.

The immediate confirmed effect is that the documented commands cannot operate from this package as supplied. Security exploitation would require the missing paths to be populated or replaced by another component, so malicious execution is not established by the current artifact alone.

### Attack Path

1. The agent follows `SKILL.md` and attempts to execute a referenced shell script.
2. With the package exactly as audited, execution fails because the script is absent.
3. If another installation step, compromised package source, or local attacker places a script at the expected path, the documented workflow causes that unaudited script to be invoked w
...[truncated 837 chars]

Remediation

View remediation

Remediation Suggestions

• Include the referenced scripts in the same audited and versioned package.
• Verify script integrity before invocation, using package signatures or trusted hashes.
• Fail closed when expected files are absent, replaced, writable by untrusted users, or symbolic links.
• Canonicalize and validate all repository, ref, path, URL, and destination arguments.
• Quote shell variables consistently and avoid constructing commands through string concatenation or eval.
• Safely extract archives by validating every entry before writing it to disk.
• Ensure all writes remain within a canonical staging and destination directory.
• Minimize the subprocess environment and provide authentication tokens only when required.
• Prevent tokens from appearing in command-line arguments, logs, errors, or persistent temporary files.
• Add automated tests covering command injection, traversal, symlink attacks, archive escapes, interrupted installations, and cleanup behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

- Validates that the downloaded directory contains a `SKILL.md`.

Static analysis

No suspicious patterns detected.