SkVM JIT Optimize Trigger

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:00 AM UTC
• Version: 0.1.0

Overview

The skill has a coherent optimization purpose, but users should review it because it can send task evidence to an external model and includes unsafe installer guidance.

Before installing, confirm you are comfortable with task reports or selected logs being processed by an external optimizer model. Prefer the short `report.json` format, remove credentials, tokens, private file contents, customer data, and sensitive paths, and avoid running the documented `curl | sh` installer unless you have independently verified the installer source and scope.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:134

Finding

Unverified Remote Installer Executed Through a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 134
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown

- If `skvm` is not on PATH, report it to the user and stop — do not install anything. If `skvm jit-optimize` fails with "opencode not found", tell the user to re-run the skvm installer (`curl -fsSL https://skillvm.ai/install.sh | sh` or `npm i -g @ipads-skvm/skvm`) rather than installing opencode yourself. skvm bundles its own private opencode copy and manages it through the installer.

The unsafe command is:

bash

curl -fsSL https://skillvm.ai/install.sh | sh

Technical Analysis

The Skill recommends downloading a script from an external URL and immediately passing its contents to a shell. The retrieved payload is not version-pinned, cryptographically verified, or made available for review before execution. Consequently, the effective installer can change after the Skill package has been audited.

Although this command is presented as user-facing recovery guidance and the Skill explicitly says not to perform installation automatically, executing the recommendation still creates a remote code-execution channel. HTTPS protects transport integrity under normal conditions but does not protect against compromise of the hosting infrastructure, publication account, DNS or certificate ecosystem, or the installer itself.

The alternative command, npm i -g @ipads-skvm/skvm, also installs an unpinned third-party package globally. That increases supply-chain exposure and may modify user-wide command paths or package directories. Reinstallation may be relevant when SkVM reports a missing bundled dependency, but neither direct shell piping nor an unpinned global installation is required to achieve that purpose.

Attack Path

1. An attacker compromises skillvm.ai, its hosting pipeline, distribution infrastructure, or the published `install. ...[truncated 1627 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pattern from the Skill instructions.
2. Direct users to an authenticated release page and pin a specific audited SkVM version.
3. Require a download-then-verify workflow, for example:
   • Download the installer or release artifact without executing it.
   • Verify a publisher-provided cryptographic signature or a checksum obtained through an independent authenticated channel.
   • Review the downloaded script before running it.
   • Execute the verified local file without elevated privileges unless elevation is strictly necessary.
4. Prefer signed, immutable release artifacts over a mutable URL such as /install.sh.
5. If npm installation remains supported, pin an exact audited package version and verify package provenance or integrity metadata.
6. Avoid global package installation where a project-local or isolated installation can provide the required functionality.
7. Explicitly warn users not to run the installer with sudo or from an administrative shell.
8. Document the expected files, directories, subprocesses, and permissions used by the installer so users can evaluate its scope before execution.
9. Preserve the existing safeguard that the agent must stop rather than installing software automatically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

The skill directory contains a `SKILL.md` file. You need the absolute path to pass as `--skill=<dir>` in Step 3.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

The skill directory contains a `SKILL.md` file. You need the absolute path to pass as `--skill=<dir>` in Step 3.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

The skill directory contains a `SKILL.md` file. You need the absolute path to pass as `--skill=<dir>` in Step 3.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill includes a curl ... | sh install command, a classic unsafe pattern that executes remote script content directly in the shell without prior verification. Even though the skill says not to install anything automatically and only to tell the user to rerun the installer, embedding this pattern normalizes high-risk behavior and could lead to arbitrary code execution if the remote endpoint or delivery path is compromised.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

- Never include sensitive data (API keys, private file contents) in the report.
- Never edit the skill directory directly. Proposals are stored under `$SKVM_PROPOSALS_DIR` (default `~/.skvm/proposals/`); only `skvm proposals accept` writes back into the skill.
- If `skvm` is not on PATH, report it to the user and stop — do not install anything. If `skvm jit-optimize` fails with "opencode not found", tell the user to re-run the skvm installer (`curl -fsSL https://skillvm.ai/install.sh | sh` or `npm i -g @ipads-skvm/skvm`) rather than installing opencode yourself. skvm bundles its own private opencode copy and manages it through the installer.
- One report per task. Don't batch multiple unrelated tasks into a single report.
- `OPENROUTER_API_KEY` must be set in the environment for the optimizer to run. If it is missing, the background worker will fail and `skvm proposals show <id>` will display `run: FAILED` with the reason. The parent CLI cannot detect this in advance because the API key is only used inside the detached worker.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly tells the agent to create and pass either a structured report or a conversation log to skvm jit-optimize, which then sends that material to an external optimizer model. Although it says to redact secrets, it does not clearly warn that prompts, responses, and tool-call summaries may contain sensitive user or environment data and will be transmitted off-box, creating a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.