Software Installation Assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:16 AM UTC
• Version: 1.0.0

Overview

The skill is coherent, but it includes an optional installer that can run live internet-sourced code, so it needs user review before installation.

Review this skill before installing. Prefer using Homebrew or a staged download-review-execute flow for x-cmd, and avoid the direct `curl | sh` option except in disposable environments with no sensitive files, credentials, or tokens.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: data/install.md:25
• Finding: Unpinned Remote Installer Executed Directly by a Shell## Vulnerability Details **File Location**: `data/install.md`, line 25 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```yaml command: "curl -fsSL https://get.x-cmd.com | sh" ``` ### Technical Analysis The auto-install metadata recommends downloading a mutable script from `https://get.x-cmd.com` and immediately piping the response into `sh`. The payload is neither version-pinned nor independently authenticated before execution. HTTPS provides transport protection but does not protect users if the hosting service, publishing account, DNS infrastructure, or delivered installer is compromised. Any checksum validation performed by the downloaded installer occurs only after that initial installer has already received arbitrary code-execution capability. Consequently, such validation cannot establish the integrity of the code passed directly to the shell. This behavior is unnecessary for the Skill's declared function of returning software installation instructions. It grants remotely supplied code the full privileges of the invoking user, exceeding the minimum access required for an installation-command lookup. ### Attack Path 1. An attacker compromises `get.x-cmd.com`, its deployment pipeline, publishing credentials, or related delivery infrastructure. 2. The attacker replaces the expected installer response with a malicious shell script. 3. The Skill or a user selects the documented automatic installation method. 4. `curl` retrieves the attacker-controlled response. 5. The pipe sends the response directly to `sh` without review, version pinning, signature verification, or pre-execution checksum validation. 6. The malicious script executes with the privileges and environment of the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The payload could read or modify any user-accessi ...[truncated 443 chars]
• Remediation: ## Remediation Suggestions Remove the direct `curl | sh` auto-install command from the metadata. Prefer installation through a trusted package manager such as Homebrew. If a standalone installer must be supported: 1. Publish immutable, versioned installer artifacts. 2. Download the installer to a local file without executing it. 3. Verify a cryptographic signature from a trusted publisher key or compare its SHA-256 digest against a value obtained through an independent trusted channel. 4. Display the script for manual review. 5. Require explicit user consent before execution. 6. Execute without elevated privileges and document all filesystem and shell-profile modifications. 7. Avoid representing post-download binary checksums as verification of the initial installer itself. A safer workflow should follow this pattern: ```sh curl -fSLo /tmp/x-cmd-install.sh "https://trusted.example/versioned/x-cmd-install.sh" printf '%s %s\n' "$EXPECTED_SHA256" /tmp/x-cmd-install.sh | sha256sum -c - less /tmp/x-cmd-install.sh sh /tmp/x-cmd-install.sh ```

T03 · Remote Payload Retrieval and Execution

Error

• Location: data/install.md:104
• Finding: User-Facing Auto-Install Command Executes a Mutable Remote Payload## Vulnerability Details **File Location**: `data/install.md`, line 104 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```sh curl -fsSL https://get.x-cmd.com | sh ``` ### Technical Analysis The user-facing installation option directly connects a remote HTTP response to a POSIX shell. There is no opportunity to inspect the exact downloaded content, and no pinned version, trusted signature, or checksum is validated before execution. The effective payload can therefore change after the Skill package has been reviewed. The surrounding documentation correctly labels this option as high risk, recommends avoiding it in sensitive environments, and requires explicit consent. Those warnings reduce accidental use but do not mitigate the underlying execution primitive. User consent does not establish payload integrity or prevent supply-chain compromise. The Skill only needs to provide installation-command lookups. Installing x-cmd may be a prerequisite for its chosen implementation, but executing mutable remote code is not the least-privileged way to satisfy that prerequisite because package-manager and download-review-verify alternatives are already documented. ### Attack Path 1. An attacker gains control over the installer response through compromise of the origin, release process, hosting account, DNS, or another trusted delivery component. 2. A user follows the documented auto-install option, potentially after granting the requested consent. 3. `curl` downloads the current attacker-controlled response from the endpoint. 4. The response is streamed immediately into `sh`. 5. The payload executes before any claimed checksum verification of subsequently downloaded components. 6. The attacker performs arbitrary actions available to the user's account. ### Impact Assessment Exploitation grants arbitrary user-level code execution. The malicious installer could read priva ...[truncated 469 chars]
• Remediation: ## Remediation Suggestions Delete the direct pipe-to-shell option from the user-facing guide. Retain the lower-risk Homebrew method and strengthen the manual installation workflow as follows: 1. Pin the installer to a specific immutable release rather than a moving endpoint. 2. Download it to a local file. 3. Verify its publisher signature or a checksum sourced independently of the downloaded script. 4. Require inspection and explicit confirmation before execution. 5. Run it without elevated privileges. 6. Document every expected file and shell-configuration change. 7. In automated environments, use a verified package artifact or a prebuilt trusted image rather than suppressing review through `curl | sh`. The guide should clearly distinguish verification of the initial installer from checksum verification performed by that installer on later artifacts.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

recommendation: "acceptable with review"
      requires_review: true
    - name: install-script-auto
      command: "curl -fsSL https://get.x-cmd.com | sh"
      verification: checksum
      risk_level: high
      recommendation: "avoid in sensitive environments"

• Confidence: 97% confidence
• Finding: The skill includes a direct 'curl | sh' remote execution pattern, which is inherently dangerous because it executes code fetched at runtime without prior review. Even though the document labels this method high risk and warns against use in sensitive environments, including the command in an agent skill creates a realistic path for unsafe execution if the remote endpoint or transport chain is compromised.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. Download install script
curl -fsSL https://get.x-cmd.com > /tmp/x-cmd-install.sh

# 2. REVIEW the script content (critical step)
cat /tmp/x-cmd-install.sh

• Confidence: 90% confidence
• Finding: This pattern fetches an external install script from the network, which carries supply-chain risk. Here the document explicitly instructs the user to review the script before execution, which significantly reduces risk, but the skill still normalizes obtaining executable code from a remote source and relies on manual review rather than stronger provenance guarantees.

Chaining Abuse

High

• Category: Tool Misuse

Content

**⚠️ WARNING:** This executes remote code without manual review.

```bash
curl -fsSL https://get.x-cmd.com | sh
```

**Only use when:**

• Confidence: 98% confidence
• Finding: Piping network-fetched content directly into a shell is a dangerous chaining pattern because it combines retrieval and execution in one step, leaving no meaningful opportunity for validation before code runs. The surrounding warnings help, but the skill still contains a high-risk one-liner that an agent or user could execute reflexively.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

x-cmd is entirely contained in `~/.x-cmd.root/`. To remove:

```bash
rm -rf ~/.x-cmd.root/
# Also remove from shell config (~/.bashrc, ~/.zshrc):
# [ ! -f "$HOME/.x-cmd.root/X" ] || . "$HOME/.x-cmd.root/X"
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

x-cmd is entirely contained in `~/.x-cmd.root/`. To remove:

```bash
rm -rf ~/.x-cmd.root/
# Also remove from shell config (~/.bashrc, ~/.zshrc):
# [ ! -f "$HOME/.x-cmd.root/X" ] || . "$HOME/.x-cmd.root/X"
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is broad enough to match many generic installation-related requests, which can cause this skill to be invoked when a more specific or safer skill would be more appropriate. While the file does not contain direct code-execution abuse, over-invocation increases the chance of confusing tool selection and unnecessary exposure to shell-oriented guidance.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

1. Creates `~/.x-cmd.root/` directory (user-local)
2. Downloads x-cmd core files from GitHub releases
3. Verifies SHA256 checksums of all downloaded files
4. No system modifications, no sudo required

---

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.