T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:37- Finding
Unverified Remote Installation Script Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
case.dev
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-built for case.dev legal workflows, but it includes unsafe installation guidance and under-warned handling of sensitive legal files and credentials.
Review before installing. Prefer the Homebrew install path and avoid running the curl-to-sh installer unless you independently verify the script and trust the source. Only upload legal documents, directories, recordings, or document URLs when you have authority to send them to case.dev and have checked privacy, retention, and client-confidentiality requirements. Prefer environment variables or a managed secret store over saving API keys in a local config file on shared machines.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
setup/SKILL.md:19- Finding
Setup Skill Executes a Mutable Remote Installer Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping downloaded content directly into sh creates a classic command-execution chain with no opportunity for review or validation. In the context of a setup skill that users are likely to copy-paste, this materially increases the chance of silent compromise if the upstream script is ever malicious or tampered with.
- Content
md brew install casemark/casedev/casedev # Or via shell script curl -fsSL https://raw.githubusercontent.com/CaseMark/homebrew-casedev/main/install.sh | sh # Authenticate export CASE_API_KEY=sk_case_YOUR_KEY
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The '| sh' chain causes unreviewed remote content to be executed immediately, removing any opportunity for inspection or policy enforcement. In this skill's setup context, users are explicitly encouraged to run installation commands, which makes the chaining pattern more dangerous because it is likely to be copied verbatim on systems holding API keys and legal data.
- Content
brew install casemark/casedev/casedev
macOS + Linux (shell script)
curl -fsSL https://raw.githubusercontent.com/CaseMark/homebrew-casedev/main/install.sh | sh
text Verify: `casedev --version`
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description says to use the skill when the user 'mentions case.dev, casedev, or needs legal AI tools for document processing, transcription, or research.' The latter condition is broad and overlaps with many generic legal-assistance requests, without clear boundaries or exclusion conditions, which could cause unintended invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The quick start instructs users to execute a remote shell script directly via curl piped to sh, without any integrity verification, pinning, or warning. This is dangerous because a compromised GitHub repository, network path, or modified install script would result in immediate arbitrary code execution on the user's system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to submit document URLs to an external OCR service but does not warn that document contents may be transmitted to and processed by a third-party platform. In a legal-document context, this omission is significant because files may contain privileged, confidential, or regulated data, and users may not realize they are initiating remote processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The vault workflow explicitly uploads a local file and notes automatic ingestion plus OCR, but it does not disclose the security and privacy consequence that the file is stored remotely and processed outside the local environment. Because this skill targets legal workflows, the missing warning increases the risk of accidental disclosure of privileged case materials, PII, or client records.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description is unusually broad and includes generic terms like "search", "webfetch", and "legal skills", which can cause the skill to activate in contexts unrelated to case.dev or legal research. In an agent system, unintended activation can route user data or actions to this skill unnecessarily, increasing the chance of inappropriate external lookups, confusing behavior, or privacy-impacting requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The installation instructions tell users to pipe a remotely fetched script directly into sh, which executes network-delivered code without inspection, signature verification, or checksum validation. If the source repository, transport, or dependency chain is compromised, this becomes an immediate remote code execution path on the user's machine or agent host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill recommends persisting an API key in a local config file without warning about long-lived credential storage, file permissions, shared hosts, or shell history exposure. In an agent setting, this increases the chance that sensitive credentials remain on disk and are later read by other local users, processes, backups, or logs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow instructs users to upload deposition or hearing audio to a remote case.dev vault and process it through a cloud transcription service, but it does not warn that potentially sensitive legal recordings will leave the local environment. In the legal context, these files may contain privileged, confidential, or regulated information, so omission of an explicit external-transmission notice can cause users to disclose sensitive data without informed consent or appropriate authorization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to upload files and directories to a remote case.dev vault service but does not clearly warn that potentially sensitive legal documents will leave the local environment and be transmitted to an external system. In a legal workflow context, this omission is significant because users may upload privileged, confidential, or regulated material without informed consent or proper authorization checks.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
This line fetches executable content from an external URL at runtime, creating a trust boundary violation. Because the fetched content is not authenticated beyond transport and is not verified for integrity, an attacker who can alter the source or delivery path can supply malicious code for execution.
- Content
md brew install casemark/casedev/casedev # Or via shell script curl -fsSL https://raw.githubusercontent.com/CaseMark/homebrew-casedev/main/install.sh | sh # Authenticate export CASE_API_KEY=sk_case_YOUR_KEY
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The skill fetches an external script from GitHub at runtime, introducing trust in mutable third-party content outside the local package. Even if the author intended a standard installer flow, external script fetching increases supply-chain risk because the fetched content can change independently of the skill.
- Content
brew install casemark/casedev/casedev
macOS + Linux (shell script)
curl -fsSL https://raw.githubusercontent.com/CaseMark/homebrew-casedev/main/install.sh | sh
text Verify: `casedev --version`
Static analysis
No suspicious patterns detected.