Software Installation Assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:16 AM UTC
• Version: 1.0.0

Overview

The skill is coherent, but it includes an optional installer that can run live internet-sourced code, so it needs user review before installation.

Review this skill before installing. Prefer using Homebrew or a staged download-review-execute flow for x-cmd, and avoid the direct `curl | sh` option except in disposable environments with no sensitive files, credentials, or tokens.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: data/install.md:25

Finding

Unpinned Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: data/install.md, line 25
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

yaml

command: "curl -fsSL https://get.x-cmd.com | sh"

Technical Analysis

The auto-install metadata recommends downloading a mutable script from https://get.x-cmd.com and immediately piping the response into sh. The payload is neither version-pinned nor independently authenticated before execution. HTTPS provides transport protection but does not protect users if the hosting service, publishing account, DNS infrastructure, or delivered installer is compromised.

Any checksum validation performed by the downloaded installer occurs only after that initial installer has already received arbitrary code-execution capability. Consequently, such validation cannot establish the integrity of the code passed directly to the shell.

This behavior is unnecessary for the Skill's declared function of returning software installation instructions. It grants remotely supplied code the full privileges of the invoking user, exceeding the minimum access required for an installation-command lookup.

Attack Path

1. An attacker compromises get.x-cmd.com, its deployment pipeline, publishing credentials, or related delivery infrastructure.
2. The attacker replaces the expected installer response with a malicious shell script.
3. The Skill or a user selects the documented automatic installation method.
4. curl retrieves the attacker-controlled response.
5. The pipe sends the response directly to sh without review, version pinning, signature verification, or pre-execution checksum validation.
6. The malicious script executes with the privileges and environment of the invoking user.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The payload could read or modify any user-accessi ...[truncated 443 chars]

Remediation

View remediation

Remediation Suggestions

Remove the direct curl | sh auto-install command from the metadata. Prefer installation through a trusted package manager such as Homebrew.

If a standalone installer must be supported:

1. Publish immutable, versioned installer artifacts.
2. Download the installer to a local file without executing it.
3. Verify a cryptographic signature from a trusted publisher key or compare its SHA-256 digest against a value obtained through an independent trusted channel.
4. Display the script for manual review.
5. Require explicit user consent before execution.
6. Execute without elevated privileges and document all filesystem and shell-profile modifications.
7. Avoid representing post-download binary checksums as verification of the initial installer itself.

A safer workflow should follow this pattern:

sh

curl -fSLo /tmp/x-cmd-install.sh "https://trusted.example/versioned/x-cmd-install.sh"
printf '%s  %s\n' "$EXPECTED_SHA256" /tmp/x-cmd-install.sh | sha256sum -c -
less /tmp/x-cmd-install.sh
sh /tmp/x-cmd-install.sh

T03 · Remote Payload Retrieval and Execution

Error

• Location: data/install.md:104

Finding

User-Facing Auto-Install Command Executes a Mutable Remote Payload

Content

View full analysis

Vulnerability Details

File Location: data/install.md, line 104
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

sh

curl -fsSL https://get.x-cmd.com | sh

Technical Analysis

The user-facing installation option directly connects a remote HTTP response to a POSIX shell. There is no opportunity to inspect the exact downloaded content, and no pinned version, trusted signature, or checksum is validated before execution. The effective payload can therefore change after the Skill package has been reviewed.

The surrounding documentation correctly labels this option as high risk, recommends avoiding it in sensitive environments, and requires explicit consent. Those warnings reduce accidental use but do not mitigate the underlying execution primitive. User consent does not establish payload integrity or prevent supply-chain compromise.

The Skill only needs to provide installation-command lookups. Installing x-cmd may be a prerequisite for its chosen implementation, but executing mutable remote code is not the least-privileged way to satisfy that prerequisite because package-manager and download-review-verify alternatives are already documented.

Attack Path

1. An attacker gains control over the installer response through compromise of the origin, release process, hosting account, DNS, or another trusted delivery component.
2. A user follows the documented auto-install option, potentially after granting the requested consent.
3. curl downloads the current attacker-controlled response from the endpoint.
4. The response is streamed immediately into sh.
5. The payload executes before any claimed checksum verification of subsequently downloaded components.
6. The attacker performs arbitrary actions available to the user's account.

Impact Assessment

Exploitation grants arbitrary user-level code execution. The malicious installer could read priva ...[truncated 469 chars]

Remediation

View remediation

Remediation Suggestions

Delete the direct pipe-to-shell option from the user-facing guide. Retain the lower-risk Homebrew method and strengthen the manual installation workflow as follows:

1. Pin the installer to a specific immutable release rather than a moving endpoint.
2. Download it to a local file.
3. Verify its publisher signature or a checksum sourced independently of the downloaded script.
4. Require inspection and explicit confirmation before execution.
5. Run it without elevated privileges.
6. Document every expected file and shell-configuration change.
7. In automated environments, use a verified package artifact or a prebuilt trusted image rather than suppressing review through curl | sh.

The guide should clearly distinguish verification of the initial installer from checksum verification performed by that installer on later artifacts.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill includes a direct 'curl | sh' remote execution pattern, which is inherently dangerous because it executes code fetched at runtime without prior review. Even though the document labels this method high risk and warns against use in sensitive environments, including the command in an agent skill creates a realistic path for unsafe execution if the remote endpoint or transport chain is compromised.

Content

Scanner excerpt · data/install.md (reported line 25)May include surrounding context.

md

recommendation: "acceptable with review"
      requires_review: true
    - name: install-script-auto
      command: "curl -fsSL https://get.x-cmd.com | sh"
      verification: checksum
      risk_level: high
      recommendation: "avoid in sensitive environments"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

This pattern fetches an external install script from the network, which carries supply-chain risk. Here the document explicitly instructs the user to review the script before execution, which significantly reduces risk, but the skill still normalizes obtaining executable code from a remote source and relies on manual review rather than stronger provenance guarantees.

Content

Scanner excerpt · data/install.md (reported line 81)May include surrounding context.

bash

# 1. Download install script
curl -fsSL https://get.x-cmd.com > /tmp/x-cmd-install.sh

# 2. REVIEW the script content (critical step)
cat /tmp/x-cmd-install.sh

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping network-fetched content directly into a shell is a dangerous chaining pattern because it combines retrieval and execution in one step, leaving no meaningful opportunity for validation before code runs. The surrounding warnings help, but the skill still contains a high-risk one-liner that an agent or user could execute reflexively.

Content

Scanner excerpt · data/install.md (reported line 104)May include surrounding context.

⚠️ WARNING: This executes remote code without manual review.

bash

curl -fsSL https://get.x-cmd.com | sh

Only use when:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · data/install.md (reported line 181)May include surrounding context.

x-cmd is entirely contained in ~/.x-cmd.root/. To remove:

bash

rm -rf ~/.x-cmd.root/
# Also remove from shell config (~/.bashrc, ~/.zshrc):
# [ ! -f "$HOME/.x-cmd.root/X" ] || . "$HOME/.x-cmd.root/X"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · data/install.md (reported line 181)May include surrounding context.

x-cmd is entirely contained in ~/.x-cmd.root/. To remove:

bash

rm -rf ~/.x-cmd.root/
# Also remove from shell config (~/.bashrc, ~/.zshrc):
# [ ! -f "$HOME/.x-cmd.root/X" ] || . "$HOME/.x-cmd.root/X"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to match many generic installation-related requests, which can cause this skill to be invoked when a more specific or safer skill would be more appropriate. While the file does not contain direct code-execution abuse, over-invocation increases the chance of confusing tool selection and unnecessary exposure to shell-oriented guidance.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · data/install.md (reported line 95)May include surrounding context.

md

1. Creates `~/.x-cmd.root/` directory (user-local)
2. Downloads x-cmd core files from GitHub releases
3. Verifies SHA256 checksums of all downloaded files
4. No system modifications, no sudo required

---

Static analysis

No suspicious patterns detected.