Pget

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:59 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent pget usage guide, but its reference install path tells users to install an unverified latest-release binary with sudo into a system-wide directory.

Review the install instructions before installing. Prefer a pinned, verified pget release or a trusted package manager, avoid running the download step with sudo, and choose destination paths carefully when using --force or archive extraction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/pget.md:5

Finding

Unverified Installation of a Mutable Precompiled Binary

Content

View full analysis

Vulnerability Details

File Location: references/pget.md, lines 5–8
Vulnerability Type: Supply-chain risk from an unpinned and unverified executable dependency
Risk Level: Medium

Vulnerable Code

bash

# Linux/macOS binary:
sudo curl -o /usr/local/bin/pget -L "https://github.com/replicate/pget/releases/latest/download/pget_$(uname -s)_$(uname -m)"
sudo chmod +x /usr/local/bin/pget

Technical Analysis

The installation instructions retrieve a precompiled executable from GitHub's mutable latest release URL and place it directly in the privileged /usr/local/bin directory. They neither pin an immutable release version nor verify the downloaded artifact using a cryptographic checksum or signature.

Consequently, the code reviewed during this audit does not uniquely determine the executable that users will receive. If the upstream release account, repository, release asset, or redirect target is compromised, the same documented command could install a substituted executable. HTTPS protects transport in normal circumstances but does not establish the integrity or provenance of the release artifact itself.

The command does not immediately execute the downloaded file and the documented GitHub project is not inherently malicious. Therefore, this is an insecure dependency installation process rather than evidence of an intentionally malicious payload.

Attack Path

1. An attacker compromises the upstream repository, release workflow, maintainer credentials, or mutable latest release asset.
2. The attacker replaces the platform-specific pget artifact with a malicious executable.
3. A user follows the documented installation command.
4. sudo curl writes the substituted binary to /usr/local/bin/pget.
5. The second privileged command marks the file executable.
6. The user or an agent later invokes pget as directed by SKILL.md.
7. The substituted executable runs with the privileges of ...[truncated 780 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin a specific, reviewed release version rather than using the mutable latest URL.
2. Publish checksums through a separately protected release process and verify the selected binary before installation, for example with sha256sum -c.
3. Prefer signed artifacts and verify the signature against a documented, pinned maintainer key.
4. Use failure-safe download options such as curl --fail --show-error --location.
5. Download to a temporary file, validate it, and only then install it atomically.
6. Avoid running the network client with sudo. Download and verify as an unprivileged user, then use a narrowly scoped privileged installation command.
7. Prefer a user-local executable directory when system-wide installation is unnecessary.
8. Document expected artifact names, hashes, signing keys, and a procedure for securely updating pinned versions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/pget.md (reported line 6)May include surrounding context.

Install

• Linux/macOS binary:

  bash

  sudo curl -o /usr/local/bin/pget -L "https://github.com/replicate/pget/releases/latest/download/pget_$(uname -s)_$(uname -m)"
  sudo chmod +x /usr/local/bin/pget
  

• Homebrew (macOS):

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/pget.md (reported line 7)May include surrounding context.

Install

• Linux/macOS binary:

  bash

  sudo curl -o /usr/local/bin/pget -L "https://github.com/replicate/pget/releases/latest/download/pget_$(uname -s)_$(uname -m)"
  sudo chmod +x /usr/local/bin/pget
  

• Homebrew (macOS):

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file instructs users to use --force to overwrite existing destinations, which can affect user data. The description explains how to perform the action but does not warn that overwriting may destroy existing files or should be used cautiously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file describes --force overwrite behavior and -x extraction behavior, both of which can modify existing files or create files on disk, but it provides no user warning about those side effects. For markdown files, SQP-2 applies when documentation omits warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.