Admirarr

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for managing a self-hosted media stack, but its install instruction runs an unverified remote script before the reviewed artifact can prove what will be installed.

Install only if you trust the Admirarr distribution endpoint and are comfortable with a remote installer running with your user privileges. Prefer a version-pinned download with published checksums or signatures, inspect the installer before running it, and avoid running it as root unless the publisher documents why elevation is required.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Unverified Remote Script Is Piped Directly Into a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

Install: `curl -fsSL https://get.admirarr.dev | sh`

Technical Analysis

The installation command downloads a mutable script from an external domain and immediately passes it to sh. The payload is neither pinned to a specific version nor verified with a cryptographic signature or checksum. It is also not saved for inspection before execution.

Consequently, the code that ultimately runs is controlled by the current response from get.admirarr.dev, rather than by the reviewed contents of this Skill. HTTPS protects transport in ordinary circumstances but does not establish artifact integrity if the distribution server, domain, publishing process, or upstream account is compromised.

Direct shell execution is unnecessary for the Skill's declared media-stack management functionality and exceeds the minimum safe installation mechanism. Because the project contains only documentation and no implementation or integrity metadata, the behavior of the downloaded installer and binary cannot be verified within the audited artifact.

Attack Path

1. A user or agent follows the installation instruction in SKILL.md.
2. curl requests the current payload from https://get.admirarr.dev.
3. An attacker who controls or compromises the domain, server, deployment pipeline, or hosted installer substitutes malicious shell commands.
4. The response is streamed directly to sh without inspection or integrity validation.
5. The attacker's commands execute with the privileges of the invoking account.
6. The malicious installer may then deploy a modified binary or perform any other action permitted to that account.

Impact Assessment

Successful exploitation provides arbitrary command execution with the invoking user's privileges. Potentially accessibl ...[truncated 642 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | sh installation pattern.
2. Publish immutable, versioned release artifacts through a verifiable release channel.
3. Instruct users to download the installer or binary as a separate step rather than streaming it into a shell.
4. Provide a trusted SHA-256 digest for each pinned release and require verification before execution.
5. Prefer cryptographic artifact signing, document the trusted public key, and require signature verification.
6. Pin both the release version and artifact URL; avoid mutable “latest” installer endpoints.
7. Allow users to inspect the downloaded installer before running it.
8. Document that installation should use an unprivileged account unless a specific operation demonstrably requires elevation.
9. Clearly describe installation paths, files created, permissions requested, and any interaction with Docker or service credentials.
10. Add reproducible source or other auditable implementation material so the installed binary can be compared with the reviewed release.

A safer workflow is: download a version-pinned artifact, obtain its checksum or signature through a trusted channel, verify it locally, inspect applicable installer content, and then execute or install it explicitly with the minimum necessary privileges.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill recommends installing the required binary via curl ... | sh, which executes a network-fetched script without prior verification, pinning, or integrity checking. In a skill intended for infrastructure/media-stack management, this is especially dangerous because compromise of the install endpoint, TLS interception in a misconfigured environment, or a malicious upstream change could lead to arbitrary code execution on the host running Docker and media services.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

CLI for self-hosted media server stacks. One binary, 26 commands, JSON output everywhere.

Install: `curl -fsSL https://get.admirarr.dev | sh`

## Commands

Static analysis

No suspicious patterns detected.