ClawHub
Back to skill

Security audit

Material Symbols Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Material Symbols helper, but its setup asks users or agents to execute mutable remote tooling and make lasting PATH-linked changes.

Review the setup commands before installing. Prefer installing Bun and api2cli through trusted, pinned, verifiable channels, and avoid running this skill in a sensitive home directory or privileged shell until the installer and linked executable behavior are documented and reversible.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:48
Finding

Unverified Remote Installer Executed Directly by Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 48
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
bun --version || curl -fsSL https://bun.sh/install | bash

Technical Analysis

When Bun is unavailable, this command retrieves a mutable installation script from an external URL and passes it directly to bash. The downloaded content is not pinned to a version and is not validated using a cryptographic checksum or signature. There is also no opportunity to inspect the script before execution.

Although bun.sh is the expected domain for the Bun project, the command still creates a remote-code-execution channel. A compromise of the hosting infrastructure, domain, DNS or TLS trust chain—or a malicious future modification to the installer—could cause arbitrary commands to execute with the privileges of the user running the skill.

Installing a general-purpose runtime through an immediately executed remote script exceeds the minimum privileges necessary to search for icons or generate icon assets.

Attack Path

  1. Bun is not installed or cannot be found through the current PATH.
  2. The left side of the || expression fails, triggering the curl request.
  3. An attacker compromises or influences the remote installer response or its delivery path.
  4. curl streams the attacker-controlled response directly into bash.
  5. The payload executes without integrity verification or prior review.
  6. The payload can read or modify any resource accessible to the invoking user and can make persistent changes to that user's environment.

Impact Assessment

Successful exploitation provides arbitrary command execution with the invoking user's privileges. Potential effects include theft of user-accessible files and credentials, modification of shell configuration, installation of additional software, tampering with project files, and establishment of user-level persiste ...[truncated 120 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation path and require Bun to be installed explicitly by the user.
  • Prefer an operating-system package manager or another trusted installation mechanism that supports package signing and version control.
  • If direct downloading is unavoidable:
    1. Pin an exact Bun release and immutable artifact URL.
    2. Download the artifact or installer to a file rather than piping it into a shell.
    3. Verify a publisher-provided cryptographic signature or pinned SHA-256 checksum.
    4. Allow the user to inspect and explicitly approve the installer before execution.
    5. Run installation without elevated privileges and restrict filesystem and network access where practical.
  • Document all expected filesystem and shell configuration changes.
  • Do not perform runtime installation automatically as part of ordinary icon search or generation.

T08 · Insecure Dependencies

Error
Location
SKILL.md:49
Finding

Unpinned Third-Party CLI Package Is Downloaded and Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-50
Vulnerability Type: Insecure dependency execution
Risk Level: High

bash
npx api2cli bundle material-symbols
npx api2cli link material-symbols

Technical Analysis

The setup instructions invoke api2cli through npx without specifying an exact package version or integrity value. If the package is not already installed locally, npx may retrieve and execute the version currently selected by the npm registry. This also introduces all transitive dependencies and any applicable package lifecycle behavior into the trust boundary.

The project contains only SKILL.md; it does not include the api2cli implementation or generated CLI source. Consequently, the behavior of bundle and link cannot be verified from the audited artifact. A compromised package publisher, registry account, dependency, or future package release could introduce arbitrary code after this skill has been reviewed.

The documented link operation additionally makes lasting user-environment changes by exposing an executable through ~/.local/bin and adding that directory to PATH. Such environment modification is broader than necessary for a one-time icon operation and increases the consequences of a compromised package.

Attack Path

  1. A user or agent follows the documented setup instructions.
  2. npx resolves the unversioned api2cli package through npm.
  3. An attacker compromises the package, its publisher, or a transitive dependency, or publishes malicious code in a subsequently selected release.
  4. npx downloads and executes the selected package with the invoking user's privileges.
  5. Malicious package code accesses user resources or modifies local files and configuration.
  6. During the link step, an attacker-controlled executable can be placed in or exposed through ~/.local/bin, creating a durable command-resolution risk for later sessions.

Im

...[truncated 491 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin api2cli to an exact, reviewed version rather than allowing mutable registry resolution.
  • Use a lockfile and verify package integrity hashes before execution.
  • Audit the pinned package, its transitive dependencies, lifecycle scripts, and the generated Material Symbols CLI.
  • Disable dependency lifecycle scripts where compatible with the package's documented operation.
  • Prefer installing a reviewed dependency explicitly instead of allowing npx to fetch and execute it implicitly.
  • Require explicit user approval before adding directories to PATH or creating linked executables.
  • Document every file and shell configuration entry changed by api2cli link, and provide an uninstall procedure.
  • Avoid permanent linking when a temporary, explicitly addressed executable can perform the task.
  • Consider including a small, auditable implementation in the skill package instead of dynamically retrieving executable tooling.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

curl -fsSL https://bun.sh/install | bash fetches a remote script and immediately executes it in the shell, giving the remote content full code execution on the host. If the server, transport, DNS, or upstream distribution path is compromised, or if the script changes unexpectedly, the user may run arbitrary attacker-controlled code.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

If material-symbols-cli is not found, install and build it:

bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle material-symbols
npx api2cli link material-symbols

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash construct removes any review barrier between downloaded content and execution, which is a classic command-chaining anti-pattern. In a skill file intended for operational use, this is more dangerous because it invites automated or copy-pasted execution of untrusted remote code.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

If material-symbols-cli is not found, install and build it:

bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle material-symbols
npx api2cli link material-symbols

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Using npx api2cli without pinning an exact package version allows whatever version is current on the registry at execution time to run on the user's machine. That creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could execute unintended code during setup or bundling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

A second unpinned npx api2cli invocation has the same supply-chain problem: it executes a remotely resolved package version at runtime with no reproducibility or trust boundary. In a skill context, this is especially risky because users may copy-paste setup commands assuming they are vetted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs users to install tooling, download artifacts, and write files locally, but it does not clearly warn that setup and normal usage perform network access and filesystem writes. This weakens informed consent and increases the chance that an agent or user runs the skill in an environment where such side effects are unexpected or unsafe.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.