ClawHub
Back to skill

Security audit

NeuriCo

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned but asks users to run autonomous research code with GitHub publishing and includes unsafe, unpinned installation paths.

Review this carefully before installing. Prefer the Docker path only with a pinned image digest, avoid curl | sh, use the narrowest GitHub token possible, run with --no-github or --private unless you intend to publish, and do not provide sensitive datasets or credentials until you have audited the upstream repository and runtime behavior.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:105
Finding

Unverified Remote Installer Is Executed Directly by the Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 105
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The native installation instructions retrieve a shell script from an external URL and pipe the response directly into sh. The effective code is determined by the remote server at installation time rather than by the reviewed Skill package.

HTTPS provides transport protection but does not establish that the returned script is the same version that was previously reviewed. The command does not pin an installer version or verify a cryptographic checksum or signature. A compromise of the upstream server, domain, distribution infrastructure, or publishing credentials could therefore replace the expected installer with arbitrary shell commands.

This behavior exceeds the minimum privileges necessary to install the dependency because safer installation mechanisms can retrieve a fixed release and verify it before execution.

Attack Path

  1. An attacker compromises the installer host, its publishing credentials, or another part of its delivery infrastructure.
  2. The attacker changes the response served from https://astral.sh/uv/install.sh.
  3. A user follows the documented native installation procedure.
  4. curl downloads the attacker-controlled response.
  5. The pipeline passes that response immediately to sh, without inspection or integrity verification.
  6. The payload executes with the privileges of the user running the installation command.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. The resulting scope may include:

  • Reading or altering files accessible to that user.
  • Accessing locally available credentials, tokens, and development configuration.
  • Modifying source code, research data, generated results, or shell configuration.

...[truncated 382 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | sh pipeline from the installation instructions.
  • Prefer installation through a trusted package manager using a pinned package version.
  • If an installer artifact must be downloaded:
    1. Use a version-specific, immutable release URL.
    2. Download the artifact to a local file instead of piping it into a shell.
    3. Verify a publisher-provided cryptographic signature or a checksum obtained through an independently trusted channel.
    4. Inspect the downloaded script before execution.
    5. Execute it as an unprivileged user and avoid unnecessary sudo use.
  • Pin repository revisions and container image digests in related setup instructions to reduce broader supply-chain exposure.
  • Document the files, network access, and permissions required by the installer so users can evaluate its scope before running it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (6)

Chaining Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The shell pipe into sh is a command-chaining pattern that turns network-retrieved content into immediate code execution. In a skill that already asks for OAuth logins, API keys, and GitHub access, this increases the blast radius because a compromised installer could tamper with local environment files, tokens, repositories, or host state.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

bash
git clone https://github.com/ChicagoHAI/neurico && cd neurico
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp .env.example .env   # edit: add your API keys
claude                  # login to AI CLI

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

git clone https://github.com/ChicagoHAI/neurico && cd neurico curl -LsSf https://astral.sh/uv/install.sh | sh uv sync cp .env.example .env # edit: add your API keys claude # login to AI CLI

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
| | |
|---|---|
| **What it does** | Takes a research idea (YAML) and autonomously runs the full research lifecycle: literature review, experiment design, code execution, analysis, paper writing, GitHub push |
| **Input** | YAML file with 3 required fields: `title`, `domain`, `hypothesis` |
| **Output** | Code (`src/`), results & plots (`results/`), LaTeX paper (`paper_draft/`), GitHub repo |
| **Providers** | Claude Code, Codex, Gemini (OAuth login, not API keys) |

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill instructs users to pull and run a Docker image using the mutable latest tag rather than a pinned version or digest. This creates a supply-chain risk because the image content can change over time, preventing reproducibility and allowing a compromised or maliciously replaced image to be fetched without notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest explicitly advertises autonomous experiment execution, code generation, paper compilation, and GitHub repository creation, but provides no user-facing warning or safety constraints about running code, consuming compute resources, accessing external services, or publishing artifacts. In a multi-agent research framework, this omission increases the risk that users invoke impactful operations without understanding the scope of execution or the possibility of unintended data exposure, cost, or repository publication.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The skill tells users to fetch and execute a remote install script directly with curl ... | sh, which bypasses inspection and integrity verification. If the remote endpoint, transport, or hosting account is compromised, arbitrary shell commands could execute on the user's machine during setup.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

bash
git clone https://github.com/ChicagoHAI/neurico && cd neurico
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp .env.example .env   # edit: add your API keys
claude                  # login to AI CLI

Static analysis

No suspicious patterns detected.