ClawHub
Back to skill

Security audit

AgentVerse CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent marketplace CLI wrapper, but its install path can execute mutable remote scripts and its update and credential behavior need closer review before installation.

Review this before installing. Prefer the versioned GitHub release binary path over the curl|bash or irm|iex installer, verify checksums or signatures if available, run without elevated privileges, avoid passing real tokens directly on the command line, and confirm where AgentVerse stores login credentials before using authenticated marketplace actions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
skill.json:16
Finding

Automated installation executes mutable remote scripts

Content
View full analysis

Vulnerability Details

File Location: skill.json:16-21
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The installation metadata instructs the host to download scripts from the mutable main branch of an external GitHub repository and execute them immediately:

json
"install": {
  "shell": {
    "linux": "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash",
    "macos": "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash",
    "windows": "irm https://raw.githubusercontent.com/loonghao/agentverse/main/install.ps1 | iex"
  },

Technical Analysis

Both curl ... | bash and irm ... | iex create a direct remote-code execution channel. The scripts are neither included in the audited package nor pinned to an immutable release or commit. No checksum or signature verification is performed before execution.

Installing the declared agentverse binary is relevant to the Skill's functionality, but executing an unverified, mutable installation script is not the least-trust installation approach. Because the payload is fetched from main, its effective behavior can change after this Skill has been reviewed. Compromise of the repository, maintainer account, release process, GitHub delivery path, or installation script could result in arbitrary commands being executed by the installer.

The package also declares versioned GitHub release assets under install.binary.github_release, demonstrating that a narrower installation mechanism is available. However, the shell installer remains present and can be invoked automatically by a Skill host.

Attack Path

  1. A user or automated Skill manager processes skill.json.
  2. The manager selects the platform-specific shell installation command.
  3. The command retrieves the current install.sh or install.ps1 from the repository's mutable main branch.

...[truncated 860 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash and irm | iex installation paths from machine-readable installation metadata.
  • Prefer direct downloads of version-pinned GitHub release archives already described by install.binary.github_release.
  • Pin the exact release version rather than resolving a mutable latest release or branch.
  • Publish SHA-256 checksums through a separately protected release process and verify the selected archive before extraction.
  • Prefer cryptographic artifact signatures and verify both signer identity and signature before installation.
  • If an installation script is unavoidable, reference an immutable commit, download it to a file, verify its expected digest, and require explicit review or confirmation before execution.
  • Install into a user-scoped directory without administrator privileges unless a specific privileged operation is demonstrably required.
  • Disable unattended self-update behavior or apply the same version pinning, signature verification, and user-confirmation requirements to updates.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:13
Finding

Skill instructions recommend direct execution of unverified remote installers

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-16 and SKILL.md:24-33
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The Skill metadata and installation documentation both recommend immediately executing scripts retrieved from an external repository:

yaml
install:
  - kind: shell
    linux: "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash"
    macos: "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash"
    windows: "irm https://raw.githubusercontent.com/loonghao/agentverse/main/install.ps1 | iex"
markdown
**Linux / macOS:**
```bash
curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash

Windows (PowerShell):

powershell
irm https://raw.githubusercontent.com/loonghao/agentverse/main/install.ps1 | iex
text

### Technical Analysis

The Bash pipeline executes the downloaded response as shell input, while PowerShell's `Invoke-Expression` executes the response as PowerShell source code. Neither path validates a release version, expected digest, or cryptographic signature. The use of the mutable `main` branch means the reviewed instructions do not identify the code that will execute later.

A remote installer may legitimately be used to acquire the required CLI, but immediate interpretation of an unverified network response exceeds the minimum trust necessary to install a versioned executable. The remote scripts were not present in the audited project, so their commands, file changes, privilege behavior, and dependency retrieval cannot be verified from this package.

### Attack Path

1. An agent loads the Skill and determines that the required `agentverse` binary is absent.
2. The agent, user, or Skill framework follows the installation metadata or documented command.
3. GitHub serves the current contents of the mutable installe
...[truncated 885 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace every piped installer example with a version-pinned binary installation workflow.
  • Show separate download, integrity-verification, extraction, and installation steps.
  • Pin artifacts to an immutable release and provide platform-specific SHA-256 values.
  • Verify a trusted cryptographic signature in addition to a checksum where possible.
  • If retaining scripts, pin them to an immutable commit and require users to download and inspect them before execution.
  • Clearly document the destination directory, files created, credentials used, network endpoints contacted, and whether elevated privileges are needed.
  • Recommend execution as an unprivileged user and prevent agents from automatically approving privilege elevation.
  • Ensure self-update downloads are subject to the same integrity controls and explicit authorization.

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:7
Finding

README installation guidance pipes remote content into command interpreters

Content
View full analysis

Vulnerability Details

File Location: README.md:7-15
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The public installation instructions use immediate execution of remotely retrieved content on every supported operating-system family:

markdown
**Linux / macOS:**
```bash
curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash

Windows (PowerShell):

powershell
irm https://raw.githubusercontent.com/loonghao/agentverse/main/install.ps1 | iex
text

### Technical Analysis

These commands collapse retrieval and execution into one operation. Users cannot inspect the exact payload beforehand, and no integrity control binds the response to the audited Skill version `0.1.4`. The URL targets `main`, so a future commit can silently change the code executed by unchanged instructions.

TLS protects the connection in transit but does not protect against repository-owner compromise, malicious upstream changes, or a compromised release workflow. The use of `curl -f` only handles HTTP errors; it does not authenticate the contents. Similarly, PowerShell's `irm` and `iex` provide no payload integrity validation.

### Attack Path

1. A user copies the documented installation command.
2. The command fetches the installer present on `main` at execution time.
3. The response is sent directly to the local command interpreter.
4. A modified upstream script executes arbitrary commands without any checksum mismatch or signature warning.
5. The payload operates with the user's existing access and can potentially install a substituted `agentverse` executable.

### Impact Assessment

The resulting code execution encompasses the invoking user's readable and writable resources, environment variables, credentials, and accessible network services. Running the instructions with administrative privileges would correspondingly increase the impact, altho
...[truncated 272 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the documented one-line installers with a safe, reproducible installation procedure.
  • Download an exact versioned release archive rather than a script from main.
  • Provide expected checksums in authenticated release metadata and require verification before extraction.
  • Add signature verification with a documented trusted signing key.
  • Avoid Invoke-Expression and shell pipelines for network responses.
  • Document a user-local installation path that does not require elevated privileges.
  • Explain all expected installation side effects so users can verify that installation remains within the declared CLI functionality.
  • Keep documentation, SKILL.md, and skill.json consistent so an unsafe path is not retained in any automated or manual installation channel.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The '| bash' pattern causes immediate execution of network-retrieved content, eliminating opportunities for inspection or integrity validation and turning any compromise of the source into instant arbitrary command execution. Because this is an installation instruction for a CLI skill, the context increases danger: users are primed to trust and run it to enable further agent capabilities.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

Linux / macOS:

bash
curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash

Windows (PowerShell):

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

A self-update capability allows the installed CLI to modify itself by fetching and installing newer code, which expands the trusted update channel and can lead to arbitrary code execution if the update source or distribution path is compromised. In an agent skill context, self-modification is especially risky because it changes runtime behavior after review and can bypass assumptions made during initial approval.

Content

Scanner excerpt · README.md (reported line 116)May include surrounding context.

bash
# Check for a newer version without installing
agentverse self-update --check

# Update to the latest release
agentverse self-update

Self-Modification

High
Category
Rogue Agent
Confidence
91% confidence
Finding

The README explicitly recommends updating to the latest release, which means future code is executed without the current reviewer being able to assess it. If the upstream release pipeline, repository, or transport is compromised, the CLI can be replaced with malicious code on systems using this skill.

Content

Scanner excerpt · README.md (reported line 119)May include surrounding context.

md
agentverse self-update --check

# Update to the latest release
agentverse self-update

# Update using a GitHub token (avoids rate limits)
agentverse self-update --token ghp_your_token

Self-Modification

High
Category
Rogue Agent
Confidence
93% confidence
Finding

The self-update example includes passing a GitHub token on the command line, which risks credential exposure through shell history, process listings, audit logs, and telemetry while also granting the binary authenticated access to update channels. Combined with self-modification, this increases both code-execution and secret-handling risk in agent environments.

Content

Scanner excerpt · README.md (reported line 122)May include surrounding context.

agentverse self-update

Update using a GitHub token (avoids rate limits)

agentverse self-update --token ghp_your_token

text

## Global Flags

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The pipeline into bash is the key dangerous step because it turns external content retrieval into immediate execution with no review boundary. In a skill that manages marketplace artifacts and authentication, compromise of the installer could expose local credentials, tamper with CLI behavior, or seed broader supply-chain attacks.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Linux / macOS:

bash
curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash

Windows (PowerShell):

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

--score 0.95 --metric accuracy

text

### Self-Update

```bash
# Check for newer version without installing

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

bash
# Check for newer version without installing
agentverse self-update --check

# Update to the latest release
agentverse self-update

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

bash
# Check for newer version without installing
agentverse self-update --check

# Update to the latest release
agentverse self-update

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

bash
# Check for newer version without installing
agentverse self-update --check

# Update to the latest release
agentverse self-update

Self-Modification

High
Category
Rogue Agent
Confidence
93% confidence
Finding

A built-in self-update capability allows the tool to replace or modify its own executable state, which is a high-risk operation in agent environments because it changes the trusted codebase after approval. If update sources or channels are compromised, the feature can deliver malicious code or bypass review controls through an apparently legitimate maintenance action.

Content

Scanner excerpt · skill.json (reported line 54)May include surrounding context.

json
"stats": "Show social statistics for an artifact",
    "learn": "Submit a learning insight about an artifact (agent use)",
    "benchmark": "Submit benchmark results for an artifact (agent use)",
    "self-update": "Update the agentverse CLI itself to the latest version"
  },
  "examples": [
    {

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

The example explicitly encourages use of the self-update command, increasing the likelihood that an agent or user will invoke a code-changing operation without additional scrutiny. In a skill marketplace context, normalizing self-update raises supply-chain risk because the executable may change independently of the reviewed skill metadata.

Content

Scanner excerpt · skill.json (reported line 87)May include surrounding context.

json
},
    {
      "description": "Update CLI to the latest version",
      "command": "agentverse self-update"
    }
  ]
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README instructs users to execute a remotely fetched installer script directly via a shell pipeline on Unix and via iex on Windows, with no integrity verification, pinning, or warning. This creates a supply-chain execution path where a compromised GitHub account, repository, branch, CDN response, or network environment can lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The metadata-defined install command pipes a remotely fetched shell script directly into bash, which executes unreviewed code from a network source with the user's privileges. If the upstream repository, distribution channel, or network path is compromised, this becomes immediate arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The Windows install command uses Invoke-RestMethod piped to iex, which executes remote PowerShell content directly in memory without review or integrity verification. This exposes users to arbitrary code execution if the hosted script or delivery path is tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The rendered installation section repeats direct execution of remote shell and PowerShell scripts without any warning, verification step, or version pinning. Because this is user-facing documentation, it normalizes unsafe installation behavior and increases the likelihood of arbitrary code execution on user systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The install instructions pipe remote content from GitHub directly into a shell or PowerShell interpreter, which removes any opportunity for the user or calling agent to inspect what will execute. If the upstream repository, branch, CDN response, or network path is compromised, this becomes arbitrary code execution on the host during installation.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Fetching an external script from a mutable GitHub raw URL during installation introduces a classic supply-chain risk because the fetched content can change over time and is not verified before use. In a skill README, this is more dangerous because users may copy-paste commands verbatim, granting immediate execution to unreviewed remote content.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

Linux / macOS:

bash
curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash

Windows (PowerShell):

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

This command fetches an external script from GitHub at runtime, introducing supply-chain risk and dependency on the integrity of a mutable remote resource. In this case it is especially dangerous because the fetched content is immediately executed, compounding the impact to code execution.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
- agentverse
    install:
      - kind: shell
        linux: "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash"
        macos: "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash"
        windows: "irm https://raw.githubusercontent.com/loonghao/agentverse/main/install.ps1 | iex"
---

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The macOS install path repeats external script fetching from a mutable GitHub raw URL, creating a classic supply-chain exposure. Any compromise of the source or content served to users could alter installed behavior or execute malicious actions.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
install:
      - kind: shell
        linux: "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash"
        macos: "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash"
        windows: "irm https://raw.githubusercontent.com/loonghao/agentverse/main/install.ps1 | iex"
---

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The public installation example instructs users to fetch a remote script from an external service, making trust in the tool dependent on an online mutable source. Because the skill is a CLI management tool likely to be used broadly, this documentation increases the blast radius of any upstream compromise.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Linux / macOS:

bash
curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash

Windows (PowerShell):

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The Linux install command fetches a remote script from a mutable raw GitHub URL and immediately executes it with bash. This is a classic supply-chain and remote-code-execution pattern because any compromise or unexpected change in the fetched script is executed with the user's privileges.

Content

Scanner excerpt · skill.json (reported line 18)May include surrounding context.

json
},
  "install": {
    "shell": {
      "linux": "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash",
      "macos": "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash",
      "windows": "irm https://raw.githubusercontent.com/loonghao/agentverse/main/install.ps1 | iex"
    },

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The macOS install command repeats the same fetch-and-execute pattern, exposing the host to arbitrary code execution from a remote script without integrity verification or review. Because the URL targets a mutable branch path, the installed behavior can change over time independent of the reviewed skill file.

Content

Scanner excerpt · skill.json (reported line 19)May include surrounding context.

json
"install": {
    "shell": {
      "linux": "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash",
      "macos": "curl -fsSL https://raw.githubusercontent.com/loonghao/agentverse/main/install.sh | bash",
      "windows": "irm https://raw.githubusercontent.com/loonghao/agentverse/main/install.ps1 | iex"
    },
    "binary": {

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill advertises that login will save credentials locally but gives no indication where they are stored, whether they are encrypted, or what scope they grant. This can cause agents or users to store sensitive tokens on disk without informed consent, increasing the risk of credential disclosure or reuse on shared systems.

Content

No source excerpt is available for this finding.