ClawHub
Back to skill

Security audit

Vouch

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated Vouch CLI purpose, but it tells users or agents to run an unverified remote installer and handle high-value API and wallet keys in ways that deserve manual review.

Review this skill before installing. The core Vouch workflow is coherent, but do not let an agent run the curl-to-bash installer automatically; prefer a verified package or inspect and verify the installer first. Avoid putting real API keys or wallet private keys directly in command lines, and treat reset, teardown, delegation, publishing, OAuth linking, local servers, and generated agent projects as high-impact actions requiring explicit user approval.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:40
Finding

Unverified Remote Installer Is Piped Directly into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:40-42; duplicated in README.md:25-27
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable code in SKILL.md:

bash
curl -fsSL https://vouch.directory/install.sh | bash

Vulnerable code in README.md:

bash
curl -fsSL https://vouch.directory/install.sh | bash
vouch init

Technical Analysis

The installation instructions download a mutable shell script from an external server and pass it directly to Bash. The effective code is determined by the remote server at execution time rather than by the audited project contents.

No version pinning, cryptographic signature validation, checksum verification, local inspection step, or reproducible package source is provided. HTTPS protects the transport connection but does not protect users if the hosting server, DNS infrastructure, deployment pipeline, or publishing account is compromised. It also does not prevent the script from being replaced after this audit.

The package does not include the installer or Vouch CLI implementation, so the commands executed by install.sh cannot be evaluated from the supplied artifact. Executing a remote installer is relevant to installing the documented CLI, but piping it directly into a privileged shell exceeds the minimum necessary installation workflow because safer download, verification, and review steps are available.

Attack Path

  1. An attacker compromises vouch.directory, its DNS or TLS deployment environment, the installer publishing pipeline, or an authorized maintainer account.
  2. The attacker replaces https://vouch.directory/install.sh with a malicious shell payload.
  3. A user or shell-capable agent follows the documented installation command.
  4. curl retrieves the current attacker-controlled response and streams it directly into Bash.
  5. Bash executes the payload without integrity verification ...[truncated 941 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all curl | bash installation instructions from both SKILL.md and README.md.
  2. Publish immutable, versioned releases through a trusted package repository or release system.
  3. Pin the installation instructions to an explicit version rather than a mutable install.sh endpoint.
  4. Provide detached cryptographic signatures and SHA-256 checksums through an independently protected channel.
  5. Require users to download the artifact first, verify its signature and checksum, and only then execute or install it.
  6. Document the files, permissions, network destinations, and system changes made by the installer.
  7. Avoid requiring root privileges. If elevated privileges are unavoidable for a specific installation step, isolate and document that step rather than running the entire installer with elevation.
  8. Publish the installer and CLI source in the audited repository so reviewers can verify their behavior.
  9. Prefer a hardened flow such as:
    bash
    curl -fLo vouch.tar.gz https://example.invalid/releases/v1.0.0/vouch.tar.gz
echo '<published-sha256>  vouch.tar.gz' | sha256sum --check -
# Verify a detached signature, inspect the archive, then install locally.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:78
Finding

API Keys and Wallet Private Keys Are Passed as Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:78-84, with additional wallet-key examples at SKILL.md:100-104, 114-118, 132-144, 391-420, 426-430, and 580-593
Vulnerability Type: Sensitive credential exposure through command-line arguments
Risk Level: Medium

API-key example:

bash
Set an existing API key:

```bash
vouch login --api-key vk_...

Flags: --api-key <vk_...> (required). Validates against the API before saving.

text

**Wallet-key examples:**
```bash
vouch --json delegate --wallet-key 0xKEY --expiry 24h --scope messaging
bash
vouch --json publish \
  --wallet-key 0xKEY \
  --endpoint https://agent.example.com/api \
  --capabilities "chat,verify,summarize"
bash
vouch --json teardown --wallet-key 0xKEY

Technical Analysis

The documentation repeatedly instructs users to substitute API credentials and wallet keys directly into command-line arguments. Although the examples use placeholders, the prescribed usage pattern causes real credentials to become part of the executed command.

Depending on the operating system, shell, and automation environment, command arguments may be exposed through shell history, process inspection interfaces, terminal recording, CI logs, audit logs, debugging output, or agent tool-call transcripts. Wallet keys are especially sensitive because the documented operations include identity linking, delegation, publishing, revocation, reset, and teardown.

The project declares access to Bash(vouch:*), and config.json permits state-changing and destructive commands. Consequently, credential exposure is not limited to read-only account data. A disclosed wallet key could potentially be reused with commands that change or destroy identity state.

Attack Path

  1. A user follows the documented syntax and replaces vk_... or 0xKEY with a real credential.
  2. The complete command is entered into a sh ...[truncated 1338 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not accept API keys or wallet private keys through ordinary command-line arguments.
  2. Add hidden interactive prompts that disable terminal echo for manual use.
  3. Support reading secrets from standard input or a dedicated file descriptor without including them in the argument vector.
  4. Integrate with operating-system credential stores or hardware-backed wallets for long-lived identity keys.
  5. For secret files, require restrictive permissions such as owner read/write only and reject insecure permissions.
  6. Prefer transaction signing through a wallet provider rather than exporting raw private-key material to the CLI.
  7. Ensure the CLI redacts credentials from errors, debug output, telemetry, process logs, and agent transcripts.
  8. Update every --api-key and --wallet-key example to use the secure input mechanism.
  9. Add explicit warnings against placing credentials in shell history, scripts, source control, environment dumps, or CI command lines.
  10. Require interactive confirmation or an explicit narrowly scoped authorization for destructive operations such as reset and teardown.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

curl -fsSL https://vouch.directory/install.sh | bash causes immediate execution of code obtained over the network, giving that remote endpoint effective command execution on the host. Because this skill is intended for AI agents and shell-capable runtimes, the surrounding context increases risk: an agent may install and run the script automatically on developer or production systems.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

  1. Install Vouch CLI on the machine where your agent runs:

    bash
    curl -fsSL https://vouch.directory/install.sh | bash
vouch init

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash construct is a classic unsafe command chain because it removes any opportunity to inspect or validate the fetched content before execution. In a skill designed to be consumed as agent instructions, this pattern is especially hazardous since the model may treat it as an endorsed operational step and execute attacker-controlled shell commands if the upstream script is altered.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

  1. Install Vouch CLI on the machine where your agent runs:

    bash
    curl -fsSL https://vouch.directory/install.sh | bash
vouch init

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Fetching and immediately executing an external install script is a direct arbitrary code execution pattern. Because this skill is designed to be used by automation and may run on hosts with wallet keys, API keys, and agent credentials, a compromised installer could steal secrets, plant backdoors, or alter verification behavior.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Install

bash
curl -fsSL https://vouch.directory/install.sh | bash

Verify: vouch --version

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash chain removes any opportunity for inspection between download and execution and is a classic abuse pattern for silently chaining untrusted network input into a shell. In this skill's context, successful exploitation could immediately compromise cryptographic identities, delegated runtime keys, account credentials, and any generated agents on the machine.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Install

bash
curl -fsSL https://vouch.directory/install.sh | bash

Verify: vouch --version

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to execute a remotely fetched shell script directly with bash, without any integrity verification, pinning, or review step. In an agent skill context, this is more dangerous because an autonomous or semi-autonomous agent may follow the instruction verbatim, turning a documentation example into arbitrary code execution if the remote host, TLS path, or script content is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The install step pipes a remotely fetched script directly into bash without any integrity check, pinning, or warning. This allows compromise of the distribution server, DNS/TLS interception, or upstream script changes to result in arbitrary code execution on the host running the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The onboarding flow creates local cryptographic keys, writes persistent config, opens OAuth flows, and links external identities, but the skill does not prominently warn about those side effects before recommending vouch init as the first command. In an agent context, hidden state changes and account-linking actions can cause unintended credential creation, persistence, or binding of operator identities to automation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The agent creation flow explicitly prompts for an OpenAI API key and generates a persistent project under ~/.vouch/agents/<name>/, creating a risk of credential persistence in local files, shell history, scaffolds, or generated configs if storage practices are weak. In a skill intended for agents, long-lived secrets and generated runtime state increase the blast radius of host compromise or accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md
Create, run, and deploy OpenAI-powered agents that communicate using Vouch envelopes.

### Create an agent

Interactive wizard that generates a ready-to-deploy agent project:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 561)May include surrounding context.

bash
SIGNED=$(vouch --json sign --payload '{"task":"deploy","id":"cr-42"}')
echo "$SIGNED" | curl -s -X POST -H "Content-Type: application/json" -d @- https://recipient.example.com/inbox

Reset