p4u

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:20 PM UTC
• Version: 0.0.0-nightly.e055304

Overview

The skill is purpose-aligned for Perforce work, but its install instructions rely on mutable remote binaries that would gain ongoing access to local workspaces and Perforce sessions.

Review the install path before using this skill. Prefer a pinned, signed, versioned p4u release or build from auditable source, avoid installing nightly binaries into system-wide PATH, and keep the confirmation rule for delete, revert, client deletion, and force operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:31
• Finding: Mutable Remote p4u Executable Download Without Independent Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 31–54 **Vulnerability Type**: Remote executable retrieval through a mutable release channel **Risk Level**: High The Skill instructs users to download a precompiled `p4u` executable from the personal GitHub repository identified in `_meta.json` as belonging to `m9rco`. The downloaded executable is subsequently installed into a PATH directory. ```bash BASE="https://github.com/m9rco/p4u-skill/releases/download/nightly" curl -fsSL "${BASE}/p4u-${OS}-${ARCH}" -o /tmp/p4u curl -fsSL "${BASE}/checksums.txt" -o /tmp/p4u-checksums.txt # Verify integrity before installing (works on both macOS and Linux) EXPECTED=$(grep "p4u-${OS}-${ARCH}" /tmp/p4u-checksums.txt | awk '{print $1}') ACTUAL=$(command -v sha256sum >/dev/null 2>&1 && sha256sum /tmp/p4u | awk '{print $1}' || shasum -a 256 /tmp/p4u | awk '{print $1}') [ "$EXPECTED" = "$ACTUAL" ] || { echo "Checksum mismatch — aborting"; rm -f /tmp/p4u; exit 1; } chmod +x /tmp/p4u && sudo mv /tmp/p4u /usr/local/bin/p4u ``` ```powershell Invoke-WebRequest -Uri "https://github.com/m9rco/p4u-skill/releases/download/nightly/p4u-windows-amd64.exe" ` -OutFile "$env:USERPROFILE\AppData\Local\Microsoft\WindowsApps\p4u.exe" ``` ### Technical Analysis The `nightly` release reference is mutable, so the executable delivered to a user can change after the Skill has been reviewed. No source code for the binary is present in the audited package, preventing the downloaded implementation from being inspected as part of this audit. On Windows, the executable is downloaded directly into a user PATH directory without checksum, digital-signature, or provenance verification. On macOS and Linux, a SHA-256 comparison is performed, but `checksums.txt` is retrieved from the same mutable release and administrative trust boundary as the executable. An attacker able to replace the binary can therefore replace its checksum as we ...[truncated 1648 chars]
• Remediation: ## Remediation Suggestions 1. Publish the complete, reproducible source code for `p4u` so the executable behavior can be audited. 2. Replace the mutable `nightly` reference with an immutable, versioned release. 3. Pin expected SHA-256 digests directly in the reviewed Skill or another independently controlled, immutable trust channel. 4. Do not rely on a checksum downloaded from the same release location as the artifact. 5. Add equivalent integrity verification on Windows and validate an Authenticode signature from an expected publisher. 6. Sign release artifacts and verify signatures or supply-chain attestations before installation. 7. Prefer installation into a user-scoped directory unless system-wide availability is explicitly required. 8. Continue requiring the user to approve installation, and display the pinned version, digest, publisher, and destination before proceeding.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63
• Finding: Perforce CLI Installed System-Wide Without Artifact Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 63–66 **Vulnerability Type**: Unverified third-party executable dependency **Risk Level**: Medium The Linux installation instructions download the Perforce CLI as a raw executable and move it into a system-wide PATH directory without validating a vendor signature or independently pinned digest. ```bash curl -fsSL "https://cdist2.perforce.com/perforce/r24.2/bin.linux26x86_64/p4" \ -o /tmp/p4 && chmod +x /tmp/p4 && sudo mv /tmp/p4 /usr/local/bin/p4 ``` ### Technical Analysis HTTPS authenticates the network endpoint during transport but does not independently establish the provenance or integrity of the hosted executable if the distribution infrastructure or artifact itself is compromised. The command immediately marks the downloaded file executable and uses `sudo` to place it at `/usr/local/bin/p4`. The URL uses the declared vendor's domain, which provides a stronger trust signal than an unrelated host. Nevertheless, there is no checksum, package signature, executable signature, or other independently verified provenance check. The use of `/tmp/p4` also relies on a predictable temporary path, although the observed command downloads the file before moving it and no concrete local privilege-escalation path is established by the available evidence. ### Attack Path 1. An attacker compromises the vendor's distribution infrastructure, the hosted artifact, or another component capable of serving a substituted file through the trusted endpoint. 2. A user runs the documented Linux installation command. 3. The substituted file is made executable and moved to `/usr/local/bin/p4`. 4. A later Perforce operation invokes the malicious `p4` executable from PATH. 5. The executable runs with the invoking user's filesystem access and Perforce session context. ### Impact Assessment A substituted `p4` executable could execute arbitrary code under any account t ...[truncated 575 chars]
• Remediation: ## Remediation Suggestions 1. Prefer the vendor's signed operating-system package repository or another package format that verifies publisher signatures. 2. If a raw executable is necessary, pin and verify a vendor-published SHA-256 digest obtained through an independent, authenticated channel. 3. Verify a vendor cryptographic signature and enforce the expected signing identity before installation. 4. Download to a securely created temporary file or directory rather than a predictable shared path. 5. Avoid system-wide installation when a user-scoped executable directory satisfies the task. 6. Pin an exact supported version and document a controlled update process rather than implicitly trusting future artifact replacement.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Verify integrity before installing (works on both macOS and Linux)
EXPECTED=$(grep "p4u-${OS}-${ARCH}" /tmp/p4u-checksums.txt | awk '{print $1}')
ACTUAL=$(command -v sha256sum >/dev/null 2>&1 && sha256sum /tmp/p4u | awk '{print $1}' || shasum -a 256 /tmp/p4u | awk '{print $1}')
[ "$EXPECTED" = "$ACTUAL" ] || { echo "Checksum mismatch — aborting"; rm -f /tmp/p4u; exit 1; }
chmod +x /tmp/p4u && sudo mv /tmp/p4u /usr/local/bin/p4u
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

# Verify integrity before installing (works on both macOS and Linux)
EXPECTED=$(grep "p4u-${OS}-${ARCH}" /tmp/p4u-checksums.txt | awk '{print $1}')
ACTUAL=$(command -v sha256sum >/dev/null 2>&1 && sha256sum /tmp/p4u | awk '{print $1}' || shasum -a 256 /tmp/p4u | awk '{print $1}')
[ "$EXPECTED" = "$ACTUAL" ] || { echo "Checksum mismatch — aborting"; rm -f /tmp/p4u; exit 1; }
chmod +x /tmp/p4u && sudo mv /tmp/p4u /usr/local/bin/p4u
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

EXPECTED=$(grep "p4u-${OS}-${ARCH}" /tmp/p4u-checksums.txt | awk '{print $1}')
ACTUAL=$(command -v sha256sum >/dev/null 2>&1 && sha256sum /tmp/p4u | awk '{print $1}' || shasum -a 256 /tmp/p4u | awk '{print $1}')
[ "$EXPECTED" = "$ACTUAL" ] || { echo "Checksum mismatch — aborting"; rm -f /tmp/p4u; exit 1; }
chmod +x /tmp/p4u && sudo mv /tmp/p4u /usr/local/bin/p4u
```

**Windows** (PowerShell):

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

EXPECTED=$(grep "p4u-${OS}-${ARCH}" /tmp/p4u-checksums.txt | awk '{print $1}')
ACTUAL=$(command -v sha256sum >/dev/null 2>&1 && sha256sum /tmp/p4u | awk '{print $1}' || shasum -a 256 /tmp/p4u | awk '{print $1}')
[ "$EXPECTED" = "$ACTUAL" ] || { echo "Checksum mismatch — aborting"; rm -f /tmp/p4u; exit 1; }
chmod +x /tmp/p4u && sudo mv /tmp/p4u /usr/local/bin/p4u
```

**Windows** (PowerShell):

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill description is extremely broad ('Use for any p4 task' and 'Prefer over raw p4 commands'), which can cause the agent to invoke this skill for many ordinary repository-management requests without strong scoping. Because the skill includes destructive capabilities such as deleting clients, deleting changelists, and reverting files, overbroad activation materially increases the chance of unsafe or unintended execution.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

EXPECTED=$(grep "p4u-${OS}-${ARCH}" /tmp/p4u-checksums.txt | awk '{print $1}')
ACTUAL=$(command -v sha256sum >/dev/null 2>&1 && sha256sum /tmp/p4u | awk '{print $1}' || shasum -a 256 /tmp/p4u | awk '{print $1}')
[ "$EXPECTED" = "$ACTUAL" ] || { echo "Checksum mismatch — aborting"; rm -f /tmp/p4u; exit 1; }
chmod +x /tmp/p4u && sudo mv /tmp/p4u /usr/local/bin/p4u
```

**Windows** (PowerShell):

• Confidence: 88% confidence
• Finding: The installation instructions include `sudo mv` into `/usr/local/bin`, which normalizes privileged execution as part of the skill workflow. Even though the rules say not to auto-install, embedding privileged commands in a skill increases the chance an agent or user follows them without sufficient review, especially when the binary is downloaded from a nightly release URL.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Linux:**
```bash
curl -fsSL "https://cdist2.perforce.com/perforce/r24.2/bin.linux26x86_64/p4" \
  -o /tmp/p4 && chmod +x /tmp/p4 && sudo mv /tmp/p4 /usr/local/bin/p4
```

**Windows:**

• Confidence: 90% confidence
• Finding: This line instructs downloading `p4` and moving it into a system path with `sudo`, again encouraging privileged execution of a fetched binary. Combining network download with elevated installation raises supply-chain and local privilege risk if the artifact or channel is compromised.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The decision tree says to 'act immediately, no clarifying questions needed' and maps broad natural-language requests directly to commands. In a skill that can switch changelists, unshelve, revert, or delete Perforce state, this encourages autonomous execution from ambiguous language and reduces the safety margin around sensitive repository operations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```bash
p4u delete-client --non-interactive        # uses current client
p4u delete-client -c myclient --non-interactive
p4u delete-client -f --non-interactive     # skip confirmation
p4u delete-client -n --non-interactive     # keep local files
```

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```bash
p4u delete-cl <CL> --non-interactive
p4u delete-cl -f <CL> --non-interactive   # force, no confirmation
p4u delete-cl <CL1> <CL2> --non-interactive
```

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.