ClawHub
Back to skill

Security audit

cli-hub

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed enterprise-tool gateway, but it includes an unsafe remote installer and broad triggers for business-account actions, so it needs review before use.

Prefer pipx or uv installation, avoid the curl-to-bash convenience command, install only the specific provider you need, and review each command before it sends messages, changes enterprise data, authenticates accounts, or spends AI-generation credits.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:31
Finding

Mutable Remote Installer Executed Directly Through a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -sSL https://raw.githubusercontent.com/agentrix-ai/clihub/main/install.sh | bash

Technical Analysis

This installation command retrieves install.sh from the mutable main branch of an external GitHub repository and immediately pipes its contents into Bash. The payload is executed without being pinned to an immutable commit, saved for inspection, or validated using a cryptographic checksum or signature.

Consequently, the code that executes can change after the Skill has been reviewed. Compromise of the referenced repository, its maintainer account, or the upstream distribution process could replace the installer with arbitrary shell commands. The document claims that the script only installs a package from PyPI, but the installer itself is not included in the audited project, so that claim cannot be verified from the available artifact.

This execution method is not necessary for the declared functionality. The same document already provides direct pip, pipx, and uv package installation methods. In particular, pipx and uv tool install provide more isolated alternatives without directly executing a remotely hosted shell script.

Attack Path

  1. An attacker compromises the upstream repository or an authorized maintainer account, or otherwise causes the mutable main/install.sh resource to serve malicious content.
  2. A user or agent follows the alternative installation instruction in SKILL.md.
  3. curl downloads the current remote payload without pinning or integrity verification.
  4. The shell executes the downloaded content immediately through the pipe.
  5. The payload performs arbitrary actions using the privileges of the invoking account, potentially including credential collection, file modification, additional pa ...[truncated 881 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash installation alternative and retain isolated package installation methods such as:

    bash
    pipx install agent-cli-hub

    or:

    bash
    uv tool install agent-cli-hub

  2. Pin the package to a reviewed version rather than automatically installing the latest release.

  3. If a shell installer is operationally indispensable:

    • Reference an immutable, reviewed commit rather than the mutable main branch.
    • Download the installer to a local file instead of piping it directly into a shell.
    • Verify it against a trusted, separately published cryptographic checksum or signature.
    • Inspect the verified file before execution.
    • Run it without administrative privileges and within an appropriately restricted environment.

  4. Use failure-aware download flags such as curl --fail --show-error --location so HTTP errors are not silently passed into the execution flow.

  5. Document every package and provider CLI installed by the tool, pin reviewed versions and hashes where supported, and request only the authentication scopes required for explicitly authorized operations.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The command explicitly chains a network fetch into bash, which is a classic dangerous pattern because it converts remote content into immediate shell execution. In a skill meant for agent-guided use, this is more dangerous because broad activation could lead users toward executing the command with little scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Alternative (convenience script, internally runs pip from PyPI):

bash
curl -sSL https://raw.githubusercontent.com/agentrix-ai/clihub/main/install.sh | bash

After installation, cli-hub is available as a command.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation description is broad enough to match many ordinary productivity requests such as messaging, calendars, documents, meetings, and media generation. That increases the chance the skill is invoked by default in contexts where users did not explicitly request this third-party CLI, expanding the attack surface to installation, authentication, and external tool execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill recommends a convenience installation path that downloads and executes a remote shell script without presenting a safety warning or integrity-verification step. If the remote source, network path, or hosting account is compromised, users could execute arbitrary code on their system immediately.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching a script directly from a remote URL and piping it into a shell executes unreviewed code from the network in a single step. This bypasses normal inspection and creates a straightforward arbitrary-code-execution path if the script contents or delivery channel are altered.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Alternative (convenience script, internally runs pip from PyPI):

bash
curl -sSL https://raw.githubusercontent.com/agentrix-ai/clihub/main/install.sh | bash

After installation, cli-hub is available as a command.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The note says 'the agent should prompt the user to complete browser authorization,' but the document otherwise centers Chinese enterprise platforms and bilingual labels without clarifying that language or locale should follow user preference. While not an explicit hard language mandate, the skill lacks a user-choice statement for language/locale despite cross-locale platform use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.