Alexa Cli.Bak

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 1.0.0

Overview

The skill matches its Alexa-control purpose, but it can affect smart-home devices and expose Alexa data while installing an unpinned unofficial CLI, so it belongs in Review.

Review this before installing if your Alexa account controls locks, thermostats, plugs, alarms, or private calendars/history. Use it only with an account and devices you are comfortable allowing an agent to control, require explicit confirmation for physical actions, avoid logging returned personal data, and prefer a pinned or otherwise verified alexacli release if available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:14

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 14-29
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

yaml

      "install":
        [
          {
            "id": "brew",
            "kind": "brew",
            "formula": "buddyh/tap/alexacli",
            "bins": ["alexacli"],
            "label": "Install alexacli (brew)",
          },
          {
            "id": "go",
            "kind": "go",
            "module": "github.com/buddyh/alexa-cli/cmd/alexa@latest",
            "bins": ["alexacli"],
            "label": "Install alexa-cli (go)",
          },
        ],

Technical Analysis

The Skill defines two installation sources for the alexacli executable without pinning either source to an audited immutable version. The Go installation explicitly uses the mutable @latest selector. The Homebrew installation relies on the external third-party tap buddyh/tap without declaring a version, commit, checksum, or signature.

Consequently, the code installed in the future may differ from the code that was reviewed. If the upstream repository, release process, maintainer account, Go module, or Homebrew tap is compromised, a malicious update could be distributed through the legitimate installation instructions.

This dependency is security-sensitive because the installed executable authenticates to Amazon's unofficial Alexa API, can access locally stored Alexa credentials, and can issue commands to connected smart-home devices. The finding does not establish that the current upstream package is malicious; it identifies the absence of controls that would prevent a future upstream change from silently altering the installed payload.

Attack Path

1. An attacker compromises the upstream project, a maintainer account, release infrastructure, Go module distribution path, or the third-party Homebrew tap.
2. The attacker publishes a mali ...[truncated 1472 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a specific audited release or immutable commit identifier.
2. Pin the Homebrew installation to a reviewed version rather than implicitly installing the current formula.
3. Publish and verify cryptographic checksums for release artifacts before installation.
4. Prefer signed releases and validate signatures against a documented, trusted maintainer key.
5. Where feasible, use an official or otherwise independently trusted distribution channel instead of an unverified third-party tap.
6. Record the exact reviewed dependency version and digest in the Skill metadata so future updates require explicit review.
7. Run the CLI with least privilege and restrict access to its credential file using appropriate filesystem permissions.
8. Avoid exposing refresh tokens broadly through inherited environment variables, logs, or debugging output.
9. Establish a dependency-update process that reviews source changes and regenerates trusted hashes before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly enables natural-language execution of safety-relevant smart home actions, including locking doors and changing thermostats, but provides no warning, confirmation guidance, or usage constraints. In an agent context, this increases the chance of unintended or socially engineered physical-world actions because free-form user input may be translated directly into device control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents commands that can retrieve personal information, such as calendar entries and voice activity history, without warning that outputs may expose sensitive household data. In an agent setting, this can lead to inadvertent disclosure of private information to unauthorized users, logs, or downstream tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.