Whisper Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent networking purpose, but it should be reviewed because it tells users to run an unverified internet installer in a shell before using a credentialed network identity tool.

Review the installer before using this skill. Prefer a package manager or a versioned, signed release with checksum/signature verification; run it without administrative privileges; use a narrowly scoped API key if available; and understand that connected traffic may be attributed to the created Whisper identity.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:33

Finding

Unverified Remote Installer Is Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 33
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl get.whisper.online | sh                 # install the whisper CLI

Technical Analysis

The installation instructions download mutable content from an external server and pipe it directly into sh. The effective installer is therefore neither contained in nor reviewable as part of this Skill. The command does not pin a release, verify a cryptographic signature or checksum, save the response for inspection, or cause curl to fail explicitly on HTTP errors.

Installing the Whisper CLI supports the Skill's stated identity and egress functionality, but executing an unverified remote script is not the minimum-risk or minimum-privilege installation approach. The repository provides no evidence from which the fetched payload's contents or trustworthiness can be established. Any future change to the server response becomes executable without requiring a corresponding reviewed change to this Skill.

Attack Path

1. A user or Agent loads the Skill and follows its identity provisioning instructions.
2. The environment requests content from get.whisper.online.
3. The remote service, its hosting account, or another compromised delivery component supplies attacker-controlled shell commands.
4. The pipe passes those commands directly to sh.
5. The commands execute with all privileges and environmental access held by the invoking user.
6. The payload may then read credentials, modify user-accessible files, install additional software, or establish persistence. These latter actions are potential consequences; their presence is not verifiable from the repository because the remote payload was not included.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The accessible scope may include the user's files, environm ...[truncated 487 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the curl | sh installation path with a package from a documented package repository or a versioned release artifact.
2. Pin an explicit CLI version rather than downloading mutable installer content from an unversioned endpoint.
3. Publish cryptographic checksums and, preferably, signed release artifacts with independently documented verification keys.
4. Require users to download the artifact to a file, verify its signature or checksum, and inspect it before execution.
5. Use secure transport explicitly and make download failures fatal, for example with curl --fail --show-error --location --proto '=https'.
6. Document the installer source, installed files, required permissions, network destinations, and uninstall procedure.
7. Run installation and the CLI without administrative privileges unless a specifically documented operation requires elevation.
8. Separate installation from authentication so WHISPER_API_KEY is not exposed to installer code, and advise using a narrowly scoped credential where supported.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

curl get.whisper.online | sh is a classic arbitrary code execution pattern because it fetches code from the internet and executes it immediately in the shell. In this skill's context, the command is positioned as the primary installation path for a networking/identity tool that will also handle an API key, so compromise could lead to host takeover, credential theft, persistence, or malicious network configuration.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Give THIS agent an identity (needs a Whisper API key)

bash

curl get.whisper.online | sh                 # install the whisper CLI
whisper login                                # or: export WHISPER_API_KEY=whisper_live_...
whisper agent create --name <agent-name>     # mint the agent's /128 identity
whisper connect <agent-name>                 # local SOCKS5/HTTP egress bound to the /128

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to pipe a remote network response directly into sh without any integrity verification, review step, pinning, or warning. Even if the vendor is legitimate, a compromised server, TLS interception failure, or malicious update would result in immediate arbitrary code execution on the host running the skill.

Content

No source excerpt is available for this finding.