UXC

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:15 AM UTC
• Version: 1.0.4

Overview

This is a disclosed UXC helper for calling remote APIs, with normal integration risks around installing the CLI, sending data to chosen endpoints, and storing credentials.

Before installing, prefer a trusted package manager or pinned release for UXC. Use this skill only with endpoints you trust, keep payloads minimal, avoid sending secrets or local context unless required, verify credential bindings before live calls, and start with read-only operations before any mutation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:29
• Finding: Mutable Remote Installer Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29-45 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Medium ### Vulnerable Code ```bash **Homebrew (macOS/Linux):** ```bash brew tap holon-run/homebrew-tap brew install uxc ``` **Install Script (macOS/Linux, review before running):** ```bash curl -fsSL https://raw.githubusercontent.com/holon-run/uxc/main/scripts/install.sh -o install-uxc.sh # Review the script before running it less install-uxc.sh bash install-uxc.sh ``` **Cargo:** ```bash cargo install uxc ``` ``` ### Technical Analysis The documented installation flow downloads a shell script from the mutable `main` branch of an external GitHub repository and subsequently executes it with `bash`. The downloaded content is not pinned to an immutable commit or release and is not authenticated through a cryptographic signature or checksum. Although the instructions tell the user to review the script before execution, manual review is not an enforceable integrity control. The content may change after the Skill itself has been audited, and users may skip or inadequately perform the review. Consequently, the effective executable payload is controlled by the current state of the upstream repository rather than by the reviewed Skill package. The Homebrew and Cargo alternatives also do not pin a package version. Those methods create additional supply-chain exposure, but the direct download-and-execute sequence presents the clearest confirmed remote execution channel. Installing UXC is relevant to the Skill's declared functionality, but retrieving mutable executable code without integrity verification exceeds the minimum risk necessary to satisfy that prerequisite. ### Attack Path 1. An attacker compromises the upstream `holon-run/uxc` repository, a maintainer account, or its publication process. 2. The attacker modifies `scripts/install.sh` on the `main` branch with malicious shell commands. 3. A use ...[truncated 1232 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable `main` URL with an immutable release artifact or commit-specific URL. 2. Publish a trusted SHA-256 checksum for each supported platform and require verification before execution. 3. Prefer signed release artifacts and verify signatures against a documented maintainer key. 4. Pin Homebrew and Cargo installations to reviewed versions where the package managers support it. 5. Avoid presenting remote shell-script execution as the default installation path; prioritize reproducible package-manager installation from a trusted, versioned release. 6. If a script remains necessary, vendor the reviewed installer into the Skill package or provide explicit instructions to compare it against a documented digest. 7. Run installation with ordinary user privileges and clearly warn users not to invoke the installer with `sudo` unless a documented operation specifically requires elevation. 8. Document the files, directories, and network destinations the installer is expected to access so users can identify unexpected behavior during review. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes an operational integration skill for discovering and calling remote APIs through UXC. The actual code chunk only validates repository documentation and metadata using shell checks and ripgrep. Its primary purpose is static linting/validation of skill packaging and docs, not API discovery or execution. There is no network access, no invocation of UXC against remote hosts, and no protocol-specific handling beyond checking that certain documentation text exists. This is a material description-behavior mismatch.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs agents to call remote hosts and send structured input, but it does not prominently warn that user data, secrets, prompts, or local context may be transmitted to external endpoints. In an agent setting, this can lead to unintended data exfiltration or privacy violations if sensitive content is passed through the tool without explicit user awareness or consent.

Static analysis

No suspicious patterns detected.