Hide My Email

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:18 PM UTC
• Version: 1.0.1

Overview

The skill’s Hide My Email purpose is coherent, but its installer runs or installs unaudited code from an external GitHub repository while also asking for broad macOS Accessibility access.

Review before installing. Avoid the curl-to-shell path, verify the upstream repository and exact commit before running any installer, and grant Terminal Accessibility only after you trust the installed code. The package does not show root escalation, but it does install user-level executables and relies on broad UI automation permission.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:26

Finding

Remote Installer Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: README.md:26 and SKILL.md:19
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

README.md:26:

bash

curl -fsSL https://raw.githubusercontent.com/manikal/hide-my-email/v1.0.1/install.sh | sh

SKILL.md:19:

yaml

command: "curl -fsSL https://raw.githubusercontent.com/manikal/hide-my-email/v1.0.1/install.sh | sh"

Technical Analysis

These installation instructions stream content from an external GitHub URL directly into a shell. The downloaded content is not saved for inspection and is not authenticated using a hard-coded cryptographic checksum or trusted signature.

Although the URL refers to the v1.0.1 tag, a Git tag is not an immutable cryptographic integrity guarantee from the consumer's perspective. The effective installer remains controlled by an external repository that is outside this audited package. Compromise of the repository owner, removal and recreation of the tag, or compromise of the delivery path could alter the commands that users execute.

This behavior is not necessary for the declared functionality. A Hide My Email utility can be distributed as locally reviewable files or as a release artifact verified before execution. Directly piping remote content to a shell introduces avoidable code-execution risk.

The danger is amplified because the documentation subsequently asks the user to grant Terminal macOS Accessibility permission. That permission is relevant to UI automation, but any malicious code executed in the same authorized Terminal context may be able to automate applications and interact with sensitive user-interface elements. The reviewed command does not use sudo, so there is no evidence that it directly obtains root privileges.

Attack Path

1. An attacker compromises the upstream GitHub account or repository, or otherwise gains control over content served fo ...[truncated 1175 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all curl | sh installation instructions from README.md and SKILL.md.

2. Include the installer and executable source files directly in the reviewed Skill package where feasible.

3. If remote distribution is required, download the artifact without executing it:

   bash

   curl -fL -o install.sh https://example.invalid/releases/v1.0.1/install.sh
   

4. Publish and enforce a full, hard-coded SHA-256 digest from a separately controlled trusted channel:

   bash

   echo '<EXPECTED_SHA256>  install.sh' | shasum -a 256 -c -
   

5. Execute the installer only after successful verification and provide users an opportunity to inspect it.

6. Prefer a signed and immutable release artifact. Verify the signing identity rather than relying solely on a Git tag.

7. Clearly explain that Accessibility authorization should be granted only to the narrowest required executable or terminal environment and only after all installed code has been verified.

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:29

Finding

Mutable Upstream Repository Supplies Unaudited Installer and Runtime Executables

Content

View full analysis

Vulnerability Details

File Location: install.sh:29-41, SKILL.md:15, and README.md:18-19
Vulnerability Type: Unpinned remote code retrieval and supply-chain execution
Risk Level: High

Vulnerable Code

install.sh:29-41:

bash

if [[ -d "$INSTALL_DIR/.git" ]]; then
  echo -e "  ${DIM}Updating...${RESET}"
  git -C "$INSTALL_DIR" pull --ff-only --quiet
else
  echo -e "  ${DIM}Cloning repository...${RESET}"
  git clone --depth=1 --quiet "$REPO" "$INSTALL_DIR"
fi

# Set up bin dir with the hme script
mkdir -p "$BIN_DIR"
cp "$INSTALL_DIR/hme" "$BIN_DIR/hme"
cp "$INSTALL_DIR/hide_my_email.applescript" "$BIN_DIR/hide_my_email.applescript"
chmod +x "$BIN_DIR/hme"

SKILL.md:15:

yaml

command: "git clone --depth=1 https://github.com/manikal/hide-my-email.git ~/.hme && chmod +x ~/.hme/hme && echo 'export PATH=\"$HOME/.hme/bin:$PATH\"' >> ~/.zshrc && echo 'Installed. Restart your shell, then run: hme \"Test\"'"

README.md:18-19:

bash

git clone --depth=1 https://github.com/manikal/hide-my-email.git ~/.hme
~/.hme/install.sh

Technical Analysis

All three installation paths retrieve the repository's default branch without pinning an immutable commit. The installer also runs git pull --ff-only when an existing installation is found. Fast-forward-only mode protects against local history divergence, but it does not verify that new upstream commits are trustworthy.

After retrieval, install.sh copies the remotely supplied hme and hide_my_email.applescript files into the installation directory and marks hme executable. The README path also directly executes the remotely cloned install.sh. No commit allowlist, release signature, signer verification, or expected checksum is enforced.

The displayed checksums in install.sh do not provide meaningful integrity protection. They are calculated only after the remote files have alr ...[truncated 2326 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to an immutable, reviewed commit hash rather than the repository's default branch.
2. Remove automatic git pull behavior. Updates should require an explicit version selection and repeat the full integrity-verification process.
3. Distribute hme and hide_my_email.applescript inside the audited Skill package so their complete behavior can be reviewed.
4. If remote artifacts remain necessary, publish versioned release archives with hard-coded SHA-256 values or verifiable signatures.
5. Verify the artifact before copying files, setting executable permissions, changing shell profiles, or running any downloaded installer.
6. Do not present post-download hashes as verification unless they are compared automatically against expected values obtained from a trusted, independent source.
7. Avoid automatically changing ~/.zshrc. Instead, print a correctly quoted command for the user to review, and ensure the documented PATH matches the directory where the executable is actually installed.
8. Document a reproducible update process that identifies the approved version, commit, expected hashes, signing identity, and exact files installed.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping curl output directly into sh creates a command chain that immediately executes network-delivered code, making it easy for a compromised source, release process, or transport-layer trust failure to lead to arbitrary command execution on the user's machine. In this skill's context, the risk is amplified because the tool also asks users to grant Terminal Accessibility permissions, so any executed installer or follow-on script could operate with powerful UI automation capabilities.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

Or if you prefer a one-liner (inspect install.sh first):

bash

curl -fsSL https://raw.githubusercontent.com/manikal/hide-my-email/v1.0.1/install.sh | sh

Installs to ~/.hme/bin/. No sudo required. The installer prints a command to add it to your PATH.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

curl -fsSL https://raw.githubusercontent.com/manikal/hide-my-email/v1.0.1/install.sh | sh

text

Installs to `~/.hme/bin/`. No sudo required. The installer prints a command to add it to your PATH.

Then grant Accessibility permissions to Terminal:
**System Settings → Privacy & Security → Accessibility → add Terminal**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes one-click shell installation commands that both execute fetched/local code and modify the user's shell profile by appending to ~/.zshrc, but it does not clearly warn users about these system changes. Even though this is common installer behavior, it increases risk because users may run the command without understanding that it persists PATH changes and executes code from a cloned repository.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The README recommends executing a remotely fetched script directly with curl ... | sh, which prevents users from reviewing the exact content being run at execution time. Even though the URL is version-pinned and the text suggests inspecting the script first, this pattern is dangerous because it normalizes blind remote code execution from the network.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

Or if you prefer a one-liner (inspect install.sh first):

bash

curl -fsSL https://raw.githubusercontent.com/manikal/hide-my-email/v1.0.1/install.sh | sh

Installs to ~/.hme/bin/. No sudo required. The installer prints a command to add it to your PATH.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill includes a 'curl ... | sh' installation path, which streams a remote script directly into the shell without giving the user a chance to inspect it first. Although the URL is pinned to a version tag, this pattern remains dangerous because compromise of the upstream source, tag movement, or transport/context issues could lead to immediate arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

kind: shell
        command: "git clone --depth=1 https://github.com/manikal/hide-my-email.git ~/.hme && chmod +x ~/.hme/hme && echo 'export PATH=\"$HOME/.hme/bin:$PATH\"' >> ~/.zshrc && echo 'Installed. Restart your shell, then run: hme \"Test\"'"
        label: "Install hme (git clone, recommended)"
      - id: curl
        kind: shell
        command: "curl -fsSL https://raw.githubusercontent.com/manikal/hide-my-email/v1.0.1/install.sh | sh"
        label: "Install hme (curl, pinned to v1.0.1)"

Static analysis

No suspicious patterns detected.