Archive/Compression Assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:16 AM UTC
• Version: 1.0.0

Overview

This archive helper is mostly coherent, but its installation guide includes a high-risk option that runs mutable remote shell code directly on the user's machine.

Install only if you are comfortable with x-cmd as an external dependency. Prefer Homebrew or a download-review-verify workflow, and avoid the `curl | sh` auto-install option on machines with credentials, source code, or other sensitive data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: data/install.md:25
• Finding: Unreviewed Remote Installer Execution via Shell Pipeline## Vulnerability Details **File Location**: `data/install.md`, line 25 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```yaml command: "curl -fsSL https://get.x-cmd.com | sh" ``` ### Technical Analysis The installation metadata defines a command that downloads shell code from a mutable external URL and sends it directly to `sh`. The downloaded content is not included in the audited project, pinned to an immutable version, or verified against a trusted digest before execution. Consequently, the code that ultimately executes can change after this Skill has been reviewed. HTTPS protects the connection in transit but does not establish that the server is currently delivering a safe installer. Compromise of the domain, hosting account, deployment pipeline, DNS infrastructure, or installer source would allow an attacker to substitute arbitrary shell commands. The guide states that downloaded components receive checksum verification, but such verification occurs after the initial remote installer has already started executing. It therefore cannot protect against a malicious initial installer. ### Attack Path 1. A user submits an archive or compression request. 2. The Skill requires the external x-cmd utility and determines that it is not installed. 3. The user or an automated consumer selects the metadata-defined auto-install command. 4. `curl` retrieves the current response from `https://get.x-cmd.com`. 5. The response is passed directly to `sh` without prior inspection or cryptographic verification. 6. A compromised endpoint returns attacker-controlled shell code. 7. The shell executes that code with the permissions and environmental access of the invoking user or Agent. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installer. The remote payload could read accessible credentia ...[truncated 699 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | sh` command from machine-readable installation metadata. - Prefer a trusted package manager installation using a version-pinned package. - If script-based installation is necessary: 1. Download a versioned installer to a local file. 2. Verify it against a hard-coded SHA-256 digest or a signature rooted in a trusted public key. 3. Display or review the verified script. 4. Obtain explicit user approval. 5. Execute it with an unprivileged account in a restricted environment. - Pin all downloaded artifacts to immutable release versions rather than mutable endpoints. - Ensure verification occurs before any downloaded code is interpreted. - Do not rely on post-execution checksums to establish the integrity of the initial installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: data/install.md:104
• Finding: Documented Auto-Install Command Executes Mutable Remote Code## Vulnerability Details **File Location**: `data/install.md`, line 104 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://get.x-cmd.com | sh ``` ### Technical Analysis The auto-install instructions provide a directly executable shell pipeline that interprets the current response from an external server. There is no opportunity to inspect the downloaded content, and no pinned checksum or trusted signature is validated before `sh` begins execution. The surrounding documentation accurately warns that the method is high risk and should only be used with explicit consent in disposable environments. These warnings reduce the chance of accidental use but do not mitigate the underlying execution vulnerability. User consent also does not establish the integrity of the remotely supplied payload. The project already documents Homebrew and download-review-execute alternatives, demonstrating that direct remote execution is not necessary for the Skill's archive functionality. ### Attack Path 1. An attacker compromises or gains control over content served by `get.x-cmd.com`, or otherwise compromises its delivery supply chain. 2. The endpoint is changed to return malicious shell commands. 3. A user or Agent follows the documented auto-install command. 4. `curl` retrieves the malicious response. 5. The pipe streams the response directly into `sh`. 6. The attacker's commands execute immediately under the invoking account. 7. The payload can access local data or install additional components before any downstream checksum verification occurs. ### Impact Assessment The effective impact is arbitrary command execution under the invoking user's security context. Accessible secrets, source code, configuration, SSH material, cloud credentials, and other user data may be exposed or modified. The payload may also replace user-local tools, alter startup f ...[truncated 346 chars]
• Remediation: ## Remediation Suggestions - Delete the `curl -fsSL https://get.x-cmd.com | sh` example, including its use for disposable environments. - Retain the safer package-manager or manual-review workflows. - Replace the command with a pre-execution verification process using: - an immutable, version-specific release URL; - a trusted cryptographic signature or pinned checksum; - verification before interpretation; - explicit user approval after verification. - Run installation with no elevated privileges and with secrets removed from the environment. - Consider sandboxing the installer and limiting outbound network access to the exact artifact source. - Document the expected files and modifications so users can validate installation scope independently.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

recommendation: "acceptable with review"
      requires_review: true
    - name: install-script-auto
      command: "curl -fsSL https://get.x-cmd.com | sh"
      verification: checksum
      risk_level: high
      recommendation: "avoid in sensitive environments"

• Confidence: 98% confidence
• Finding: The documented command pipes a remotely fetched script directly into the shell, which enables immediate execution of unreviewed code from an external domain. Even though the document warns about the risk, including this as an install method in a skill increases the chance an agent or user will execute it, creating supply-chain compromise exposure.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. Download install script
curl -fsSL https://get.x-cmd.com > /tmp/x-cmd-install.sh

# 2. REVIEW the script content (critical step)
cat /tmp/x-cmd-install.sh

• Confidence: 90% confidence
• Finding: This fetches an external install script to a local file, which still introduces supply-chain risk because the content comes from a remote source and is later executed. The context partially mitigates the danger by instructing manual review before execution, so this is less severe than piping directly to shell but remains risky in an agent skill.

Chaining Abuse

High

• Category: Tool Misuse

Content

**⚠️ WARNING:** This executes remote code without manual review.

```bash
curl -fsSL https://get.x-cmd.com | sh
```

**Only use when:**

• Confidence: 99% confidence
• Finding: The '| sh' chain is the core dangerous behavior: it converts downloaded network content directly into code execution without an opportunity for validation. Within an agent skill, this is especially hazardous because automation may normalize or operationalize a pattern that bypasses review and can be weaponized if the remote host or transport is compromised.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

x-cmd is entirely contained in `~/.x-cmd.root/`. To remove:

```bash
rm -rf ~/.x-cmd.root/
# Also remove from shell config (~/.bashrc, ~/.zshrc):
# [ ! -f "$HOME/.x-cmd.root/X" ] || . "$HOME/.x-cmd.root/X"
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

x-cmd is entirely contained in `~/.x-cmd.root/`. To remove:

```bash
rm -rf ~/.x-cmd.root/
# Also remove from shell config (~/.bashrc, ~/.zshrc):
# [ ! -f "$HOME/.x-cmd.root/X" ] || . "$HOME/.x-cmd.root/X"
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill mandates invocation for essentially any archive-related request, using broad language like 'mentions or implies' and 'as long as there's an archive-related request.' This can cause the agent to route benign or ambiguous user requests into this skill unnecessarily, increasing the chance of inappropriate tool use, unintended command execution, or bypass of more context-appropriate safeguards.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

1. Creates `~/.x-cmd.root/` directory (user-local)
2. Downloads x-cmd core files from GitHub releases
3. Verifies SHA256 checksums of all downloaded files
4. No system modifications, no sudo required

---

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.