SkVM General Usage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:01 AM UTC
• Version: 0.1.0

Overview

The skill is coherent for operating skvm, but it needs Review because it tells users to run an unverified remote shell installer.

Install only if you trust skvm and its publisher. Do not run the curl-to-shell installer blindly; prefer a verified release, checksum or signature validation, and review before execution. Use API keys only for LLM-calling commands, and require explicit confirmation before expensive benchmarks/profiles or accepting proposals that overwrite skill files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17

Finding

Unverified Remote Installer Piped Directly to a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

skvm --help >/dev/null 2>&1 || { echo "skvm not installed — tell the user to run: curl -fsSL https://skillvm.ai/install.sh | sh"; exit 1; }

Technical Analysis

The Skill tells the user to download a mutable installation script from https://skillvm.ai/install.sh and pipe it directly into sh. The command provides no version pinning, cryptographic signature verification, checksum validation, or opportunity to inspect the retrieved script before execution.

Consequently, the code that will execute is not represented by the reviewed project and may change after this audit. The trustworthiness and integrity controls of the external source cannot be established from the available project contents. Compromise of the hosting service, its deployment credentials, or the network resolution path could turn the recommended installation command into an arbitrary-code-execution channel.

The Skill explicitly says not to install anything automatically and only prints the command for the user. This limits automatic exploitation, but it does not eliminate the risk: the Skill still directs the user to execute an unverified remote payload. Recommending this installation method is unnecessary for operating an already-installed CLI and exceeds the minimum behavior required for the Skill's declared functionality.

Attack Path

1. The skvm executable is not present on the user's PATH.
2. The prerequisite check fails and the Agent presents the installation command from the Skill.
3. The user executes the recommended command.
4. curl retrieves the then-current contents of https://skillvm.ai/install.sh.
5. The retrieved content is passed immediately to sh without integrity verification or review.
6. If the remote source or delivery path has been comprom ...[truncated 929 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl ... | sh recommendation from the prerequisite check.
2. Direct users to a version-pinned release hosted in a verifiable official repository or to a signed package distributed through a trusted package manager.
3. If a shell installer is unavoidable, require a staged process:
   • Download the installer to a local file.
   • Pin an immutable release version and URL.
   • Verify a published SHA-256 checksum and, preferably, a cryptographic signature from a separately authenticated channel.
   • Allow the user to inspect the file.
   • Execute it only after successful verification and explicit user approval.
4. Document the files, directories, network endpoints, and permissions used by the installer.
5. Explicitly warn users not to run the installer as root or through sudo unless a documented installation step strictly requires elevation.
6. Preserve the existing rule that the Agent must not install software automatically.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill includes a one-line curl | sh installer command fetched from the network, which is a classic supply-chain risk. Even though the skill says to tell the user to run it rather than executing it automatically, embedding this pattern encourages unsafe installation of unauthenticated remote code that could be replaced, intercepted, or compromised.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Always required — skvm is on PATH:

bash

skvm --help >/dev/null 2>&1 || { echo "skvm not installed — tell the user to run: curl -fsSL https://skillvm.ai/install.sh | sh"; exit 1; }

Required only before LLM-calling commands — profile (without --list), aot-compile, pipeline, run, bench, jit-optimize. Local filesystem commands (profile --list, proposals list|show|reject, logs, clean-jit) do not need the API key — run them even if the key is unset.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

AOT compilation rewrites a skill's `SKILL.md` (and optionally bundle files) so it fits a specific target model's capability profile. The three-pass AOT compiler

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest says this skill must not trigger when the user wants to optimize/improve a skill and should defer to the sibling skvm-jit skill. However, the file explicitly treats jit-optimize as an LLM-calling command and later provides a full section for managing jit-optimize proposals, which materially overlaps with optimization workflow handling. This creates a semantic mismatch between the stated boundary and the operational guidance in the skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

Detached runs (`skvm jit-optimize --detach`) write an extra `run-status.json` inside the proposal directory that tracks execution phase (`running` / `done` / `failed`), separate from `meta.json.status`. `skvm proposals show` renders this header and tails the last 20 lines of `run.log` for running / failed detached runs. If the user wants to stop a detached optimization mid-run, use `cancel`; sync runs (no `--detach`) do not need `cancel`, they block until complete.

**Critical rule**: only run `skvm proposals accept` when the user has **explicitly** asked to deploy. If the user just says "check the proposals", run `list` and `show` and stop there. Accepting without confirmation overwrites the skill files in place.

## Step 7: Environment variables

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 69% confidence

Finding

The prerequisite section enumerates local-only commands and proposal operations that can run without an API key, but omits proposals cancel even though a later section instructs the agent to use it for detached jit-optimize runs. This is not merely incomplete command reference material; it creates conflicting operator guidance about the intended proposal-management surface handled by this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.