Surge Download Manager

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:12 AM UTC
• Version: 1.1.0

Overview

This skill is a straightforward Surge download-manager helper, with expected download, file-write, and optional server-mode behavior disclosed in its instructions.

Install only if you trust the Surge project and its distribution channels. Prefer a pinned release or verified binary, be careful with download URLs and output paths, and start server or remote-token mode only when you intend to leave a download service running.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Unpinned Third-Party Executable Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34–38 **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # macOS brew install surge-downloader/tap/surge # Go go install github.com/surge-downloader/surge@latest ``` ### Technical Analysis The documented installation process retrieves and installs executable code from third-party sources without pinning it to a reviewed version, immutable commit, or verified artifact digest. The Go command explicitly uses the mutable `@latest` version selector. Consequently, the code installed by this command can change after the Skill has been audited. The Homebrew command uses a third-party tap without pinning a formula revision in these instructions. Neither installation path includes an independent integrity-verification step. This is a software supply-chain risk: compromise of the upstream repository, release process, maintainer account, Go module source, or Homebrew tap could cause users to install code different from the version originally reviewed. ### Attack Path 1. An attacker compromises the upstream Surge repository, a maintainer account, its release pipeline, or the third-party Homebrew tap. 2. The attacker publishes a malicious version or modifies the formula to reference a malicious artifact. 3. A user follows the documented `@latest` or unpinned Homebrew installation command. 4. The package manager retrieves and installs the attacker-controlled executable. 5. The user or wrapper subsequently invokes `surge`, executing the altered binary. 6. The malicious binary operates with the privileges of the invoking user and can access resources available to that account. This path requires compromise or malicious control of an upstream distribution source; the audited project itself does not contain an embedded malicious payload. ### Impact Assessment Successful exploitation could execute arbitrary native co ...[truncated 745 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a reviewed, immutable version or commit, for example: ```bash go install github.com/surge-downloader/surge@vX.Y.Z ``` 2. Document the exact approved release and update it only after security review. 3. Prefer downloading a versioned release artifact from the official release channel. 4. Publish expected SHA-256 or stronger cryptographic hashes and require users to verify the artifact before execution. 5. Where supported, verify signed tags, commits, release attestations, or provenance metadata. 6. For Homebrew installations, pin or otherwise document the reviewed formula revision and verify that the formula references a versioned artifact with a valid checksum. 7. Avoid recommending mutable dependency selectors such as `latest`, moving branches, or unversioned release URLs. 8. Execute the installed binary under a least-privileged account and restrict its filesystem and network access where operationally practical. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs users how to download remote content, run a headless daemon, and write files to disk, but it does not prominently warn about these side effects or the trust implications of downloading unverified files. Because the skill also documents remote control via host/token, missing warnings can lead to unsafe use, accidental background processes, or downloading malicious content without sufficient user awareness.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation criteria are broad enough that the skill may trigger for general download-related requests without clearly constraining when it should be used. In a tool that performs network access, writes files, and can start a background server, over-broad activation increases the chance of unintended execution or suggestion of risky actions in contexts where the user did not explicitly ask for them.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_surge(args_list):
    """Run surge command"""
    result = subprocess.run(['surge'] + args_list, capture_output=True, text=True)
    return result.returncode, result.stdout, result.stderr

def start_server(output_dir=None):

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(['-o', output_dir])
    
    print(f"⚡ Starting Surge server...")
    proc = subprocess.Popen(cmd)
    return proc

def main():

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.