ClawHub
Back to skill

Security audit

Jina CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent web-reading purpose, but its install and cookie examples expose users to review-worthy supply-chain and credential risks.

Review before installing. Prefer downloading and inspecting the installer or using a pinned, verified release instead of running the one-line install command. Do not pass real session cookies, internal URLs, confidential documents, or regulated data through this skill unless you explicitly trust the Jina service path and understand where that data is sent.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Unverified Remote Installer Is Piped Directly into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://raw.githubusercontent.com/geekjourneyx/jina-cli/main/scripts/install.sh | bash

Technical Analysis

The installation command downloads a shell script from a mutable branch of a personal GitHub repository and immediately executes it with Bash. The command does not pin the script to an immutable commit, verify a cryptographic checksum or signature, or allow the user to inspect the script before execution.

The remote installer is not included in the audited project, so its operations, downloaded artifacts, permission requirements, and security controls cannot be verified. The effective payload can change after this Skill has been reviewed. Consequently, compromise of the repository, maintainer account, release process, or network trust chain could turn the documented installation procedure into an arbitrary-code-execution mechanism.

Executing a remote installer is relevant to the declared need to install the CLI, but piping mutable content directly into a shell exceeds the minimum safe privileges and trust required for that purpose. A versioned, integrity-verified binary or source archive would provide the required functionality without automatically executing unreviewed content.

Attack Path

  1. An attacker compromises the geekjourneyx/jina-cli repository, its maintainer account, or another component capable of modifying the referenced script.
  2. The attacker inserts arbitrary shell commands into scripts/install.sh on the main branch.
  3. A user follows the installation instructions in SKILL.md.
  4. curl retrieves the attacker-controlled version of the script.
  5. The pipe passes the response directly to Bash without inspection or integrity verification.
  6. The malicious commands execute with all permissions availabl ...[truncated 646 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Distribute versioned binaries or source archives through an established release channel.
  • Pin downloads to an immutable release version or commit rather than the mutable main branch.
  • Publish SHA-256 or stronger checksums through an independently protected channel and verify them before execution.
  • Prefer cryptographically signed release artifacts and document signature verification.
  • Use a staged installation process: download the file, verify its origin and integrity, inspect it, and only then execute it.
  • Document every filesystem modification, network request, downloaded artifact, and privilege requirement of the installer.
  • Ensure installation runs without elevated privileges unless elevation is strictly necessary and explicitly explained.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:78
Finding

Session Cookies May Be Forwarded Through a Third-Party Reader Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:78-79
Vulnerability Type: Unsafe handling and network forwarding of sensitive authentication data
Risk Level: High

Vulnerable Code

bash
# Forward cookies
jina read -u "https://example.com" --cookie "session=abc123"

The documented default API destinations are:

text
JINA_API_BASE_URL - Read API URL (default: https://r.jina.ai/)
JINA_SEARCH_API_URL - Search API URL (default: https://s.jina.ai/)

Technical Analysis

The Skill explicitly documents a command-line option for forwarding cookies while describing the CLI as a client for network-hosted Jina Reader APIs. Session cookies are authentication secrets and can grant access to private account data or authenticated actions.

Supplying a cookie as a command-line argument can expose it through shell history, terminal logs, process inspection, diagnostic output, or command auditing. Forwarding it through a remote content-processing service also expands the credential's trust boundary beyond the original website.

The documentation does not warn users against supplying privileged session cookies, explain exactly which endpoint receives the value, define retention or logging behavior, restrict cookie forwarding to approved destinations, or describe redaction controls. Because the CLI implementation is not included in the project, the precise transmission, storage, and logging behavior cannot be verified.

Network access is necessary for the Skill's declared web-reading and search functionality. Transmission of reusable authentication credentials is not necessarily required for ordinary public-content retrieval and therefore introduces privileges beyond the minimum needed for the common use case.

Attack Path

  1. A user copies a valid authenticated session cookie from a browser or another application.
  2. The user places the cookie directly in the --cookie command-line argument.
  3. The ...[truncated 1258 chars]
Remediation
View remediation

Remediation Suggestions

  • Add a prominent warning that users must not provide privileged, long-lived, or broadly scoped session cookies.
  • Avoid accepting secrets directly as command-line arguments.
  • Read sensitive values from protected standard input, a restricted credential file, or an operating-system secret store.
  • Prevent credentials from being written to shell history, logs, telemetry, error messages, or generated output.
  • Document the exact destination, transport protection, retention policy, and processing behavior for forwarded cookies.
  • Require explicit user confirmation before transmitting authentication material to a third-party service.
  • Restrict credential forwarding to an allowlist of intended HTTPS destinations and reject redirects to unapproved hosts.
  • Use short-lived, narrowly scoped tokens instead of reusable browser session cookies where supported.
  • Prefer local authenticated retrieval when feasible so credentials remain between the user and the original target service.
  • Add automated tests verifying that secrets are redacted and are never sent to unintended API endpoints.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The specific use of '| bash' turns untrusted network content into immediate shell execution, which is a classic command-chaining anti-pattern. In a skill consumed by agents or automation, this is more dangerous because users may copy it verbatim, and the execution happens without an inspection checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Install:

bash
curl -fsSL https://raw.githubusercontent.com/geekjourneyx/jina-cli/main/scripts/install.sh | bash

Basic usage:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The example encouraging use of --cookie forwards session credentials to a remote content-fetching service without any warning about credential exposure. If users pass real authentication cookies, the external service may gain access to private account data or authenticated enterprise resources, and the cookie itself may be logged, retained, or misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documentation describes a tool that sends user-supplied URLs and search queries to Jina-hosted external APIs, but it does not clearly warn users that their inputs and fetched content leave the local environment. In an agent-skill context, this omission can cause users to unknowingly transmit sensitive internal URLs, proprietary search terms, or authenticated resources to a third party.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The install instructions fetch and execute a remote shell script directly from GitHub in a single command, giving that remote content immediate code execution on the user's machine. If the repository, branch, transport path, or upstream account is compromised, users can be silently infected without reviewing the script first.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Install:

bash
curl -fsSL https://raw.githubusercontent.com/geekjourneyx/jina-cli/main/scripts/install.sh | bash

Basic usage:

Static analysis

No suspicious patterns detected.