T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:18- Finding
Unverified Remote Installer Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
Moli Web Fetch
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent web-fetching helper, but its automatic unverified remote installer can execute changing code on the user's machine.
Install only if you are comfortable with Moli being installed locally and can verify the installer yourself. Prefer preinstalling a pinned, checksum-verified Moli release and disabling or ignoring the skill's automatic install step.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The explicit pipe into
shis a direct command-chaining pattern that turns a network fetch into immediate code execution with no validation boundary. In a skill intended for operational use, this is more dangerous because it normalizes an unsafe practice that can rapidly compromise the host if the fetched content is malicious or tampered with.- Content
bash curl --proto '=https' --tlsv1.2 -fsSL \ https://github.com/lexmount/moli/releases/latest/download/moli-installer.sh | shOn Windows, use PowerShell:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description is unusually broad and can match many generic requests involving current content, research, link following, diagnostics, screenshots, PDFs, and rendered pages, including when the tool is not explicitly named. That increases the chance of unintended activation, which is especially risky because the skill also contains installation and network-fetch behavior that could be invoked in contexts the user did not clearly request.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to install a tool by piping a remotely fetched script directly into a shell or PowerShell interpreter. That creates a software supply-chain and arbitrary code execution risk because the fetched content is not pinned, verified, or reviewed before execution, and the skill is framed for broad web-fetching tasks where such installation may be triggered routinely.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Fetching an external script from the internet and executing it as part of the documented workflow exposes the environment to arbitrary code execution if the upstream asset, release channel, repository, or transport path is compromised. Although HTTPS reduces some risk, it does not provide sufficient integrity assurance for direct execution of mutable remote installer content.
- Content
Linux or macOS:
bash curl --proto '=https' --tlsv1.2 -fsSL \ https://github.com/lexmount/moli/releases/latest/download/moli-installer.sh | sh