T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:19- Finding
Remote Installer Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Yields Llama
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent DeFi-yield purpose, but its setup asks users to execute mutable remote code and install an unverified built binary into a system-wide PATH location.
Review this skill before installing. Use a pinned, reviewed release or commit, verify checksums or signatures, avoid `curl | sh`, build only after inspecting the source and dependencies, and prefer a user-local install path such as `$HOME/.local/bin` instead of `/usr/local/bin`. The documented `.env` file appears to contain only a public API endpoint, not secrets.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:27- Finding
Unpinned External Repository Is Built and Installed Into a System-Wide Executable Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The shell pipe to 'sh' creates a direct command-execution chain from remote content to the local shell, which is a classic abuse pattern. Within a skill document, this is especially risky because users may follow setup instructions verbatim without scrutinizing the fetched script.
- Content
If Rust is not installed, run:
bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh source "$HOME/.cargo/env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
The tool needs a
.envfile in the current working directory with the DeFi Llama API endpoint. Before each run, ensure it exists:bash if [ ! -f .env ]; then echo 'LLAMA_DOMAIN="https://yields.llama.fi"' > .env; fiCLI Usage
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is described as a tool for querying DeFi yield opportunities, but the documentation directs installation of Rust, cloning a GitHub repository, building code, and copying a binary into /usr/local/bin. Those are system administration and software installation capabilities, which are not justified by the stated end-user purpose of comparing yields.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs users to run commands that install toolchains, clone and build code, write files, and copy binaries into system PATH without clearly warning about those side effects. In an agent-skill context, that increases the chance that a user or downstream automation performs privileged or persistent system modifications without informed consent.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Piping a remotely fetched script directly into 'sh' executes unreviewed code from the network at install time. If the remote endpoint, transport chain, or hosting account is compromised, users could execute arbitrary attacker-controlled code on their machine.
- Content
If Rust is not installed, run:
bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh source "$HOME/.cargo/env"
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest frames the skill as querying DeFi yield data, but the documentation instructs deleting a local cache file with
rm -f data.jsonto force refresh. File deletion is a modification capability not inherent to the user-facing purpose of comparing yield opportunities.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown includes Chinese error strings in the troubleshooting table, but the skill otherwise uses English and does not explain that the tool may emit localized output or offer a language choice. This can violate language/locale policy expectations by implicitly forcing a specific language without user opt-in.
- Content