Patrick bot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:39 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent business purpose, but it asks for broad company-data access, insecure license handling, and installation of mutable remote executables.

Review before installing. Only use this skill if you trust the Patrick publisher and service with executive and company context. Do not paste license tokens into chat; use a local secret mechanism instead. Avoid the curl-to-bash/latest install path, require pinned signed artifacts, and approve each company data source explicitly before letting an agent read or send results.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:24
• Finding: Mutable Remote Installer Is Executed Directly Through a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-28` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash Or install directly via curl: ```bash curl -fsSL https://portal.patrickbot.io/downloads/latest/install.sh | bash ``` ``` ### Technical Analysis The installation instructions pipe a script retrieved from a mutable external URL directly into Bash. The remote script is neither inspected nor verified against a version-pinned hash or a signature rooted in a trusted key bundled with the Skill. TLS protects the connection in transit, but it does not guarantee that the server, domain, publishing pipeline, or current remote script is trustworthy. The effective code executed by this Skill can consequently change after the reviewed package has been published or audited. This behavior is not necessary for the declared executive-analysis functionality. A versioned, locally reviewable, and cryptographically verified installer would provide the same installation capability with substantially less risk. ### Attack Path 1. An attacker compromises the download server, domain, TLS endpoint, or release publishing pipeline. 2. The attacker replaces `downloads/latest/install.sh` with a malicious script. 3. A user or Agent follows the documented installation command. 4. `curl` writes the attacker-controlled response directly to Bash. 5. Bash executes the payload immediately with all privileges available to the invoking user or Agent. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. The payload could read or modify files accessible to that account, steal credentials or the Patrick license, alter Agent configuration, install persistence, or download additional payloads. The reviewed code does not invoke `sudo`, so root access is not obtained unless the command is independently run by a privileged account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | bash` installation method. - Publish immutable, versioned installer artifacts instead of using `/latest/`. - Download the installer to a local file without executing it. - Verify a detached cryptographic signature using a trusted public key distributed independently with the Skill. - Abort installation if signature or version verification fails. - Allow users to inspect the verified script before executing it. - Document the exact files, network endpoints, and permissions used by the installer. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:39
• Finding: Downloaded CLI Binary Uses Fail-Open Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:39-93` **Vulnerability Type**: Untrusted executable download and ineffective integrity validation **Risk Level**: High ```bash # Download base URL — defaults to hosted server, overridable via env BASE_URL="${PATRICK_SERVER_URL:-https://portal.patrickbot.io}/downloads/latest" echo "Downloading patrick-cli for ${OS}-${ARCH}..." echo "URL: ${BASE_URL}/${BINARY_NAME}" # Download the binary if command -v curl &> /dev/null; then curl -fL "${BASE_URL}/${BINARY_NAME}" -o "$INSTALL_DIR/patrick-cli" elif command -v wget &> /dev/null; then wget "${BASE_URL}/${BINARY_NAME}" -O "$INSTALL_DIR/patrick-cli" else echo "Error: Neither curl nor wget found. Please install one of them." exit 1 fi # Verify SHA256 checksum echo "Verifying checksum..." CHECKSUMS=$(mktemp) if command -v curl &> /dev/null; then curl -fsSL "${BASE_URL}/checksums-sha256.txt" -o "$CHECKSUMS" elif command -v wget &> /dev/null; then wget -q "${BASE_URL}/checksums-sha256.txt" -O "$CHECKSUMS" fi if [ -s "$CHECKSUMS" ]; then EXPECTED=$(grep "$BINARY_NAME" "$CHECKSUMS" | awk '{print $1}') if [ -n "$EXPECTED" ]; then if command -v sha256sum &> /dev/null; then ACTUAL=$(sha256sum "$INSTALL_DIR/patrick-cli" | awk '{print $1}') elif command -v shasum &> /dev/null; then ACTUAL=$(shasum -a 256 "$INSTALL_DIR/patrick-cli" | awk '{print $1}') else echo "Warning: No sha256sum or shasum found, skipping checksum verification" ACTUAL="$EXPECTED" fi if [ "$EXPECTED" != "$ACTUAL" ]; then echo "Error: Checksum mismatch!" echo " Expected: $EXPECTED" echo " Got: $ACTUAL" rm -f "$INSTALL_DIR/patrick-cli" rm -f "$CHECKSUMS" exit 1 fi echo " Checksum verified OK" else echo " Warning: Binary not found in checksums file, skipping verificatio ...[truncated 2168 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Fail closed if the checksum manifest cannot be downloaded, lacks the exact artifact entry, or no supported hashing utility is available. - Verify a detached digital signature rather than relying only on a checksum fetched from the same origin. - Bundle or independently distribute the trusted signing public key. - Use immutable versioned URLs and bind the artifact name, version, platform, and digest into the signed metadata. - Reject non-HTTPS URLs outside an explicitly separated development mode. - Validate and constrain redirects so downloads cannot silently move to an untrusted origin. - Download to a restrictive temporary file, verify it, and only then atomically move it into the installation directory and make it executable. - Remove partial downloads on every failure path. ]]>

T08 · Insecure Dependencies

Error

• Location: install.md:53
• Finding: Manual Installation Makes a Remote Binary Executable Without Enforced Verification<![CDATA[ ## Vulnerability Details **File Location**: `install.md:53-67` **Vulnerability Type**: Unsafe third-party binary installation **Risk Level**: High ```bash mkdir -p ~/.patrick/bin curl -fL "https://portal.patrickbot.io/downloads/latest/patrick-cli-linux-x86_64" -o ~/.patrick/bin/patrick-cli chmod +x ~/.patrick/bin/patrick-cli export PATH="$HOME/.patrick/bin:$PATH" ``` The subsequent verification instructions only display values: ```bash curl -fsSL "https://portal.patrickbot.io/downloads/latest/checksums-sha256.txt" | grep patrick-cli-linux-x86_64 sha256sum ~/.patrick/bin/patrick-cli ``` ### Technical Analysis The documented primary manual path downloads a remote executable, marks it executable, and places its directory in `PATH` without requiring integrity or authenticity verification first. The later checksum instructions do not programmatically compare the expected and actual values, do not abort on mismatch, and retrieve the expected checksum from the same mutable server as the binary. This makes verification optional and vulnerable to user omission, visual comparison errors, or compromise of the common source. ### Attack Path 1. The download server, route, or release pipeline serves a modified CLI binary. 2. The user follows the primary installation block. 3. The modified binary is given executable permission and its directory is added to `PATH`. 4. The optional manual checksum display is skipped, misread, or supplied with a matching malicious checksum. 5. The user or Agent invokes `patrick-cli`, executing the substituted payload. ### Impact Assessment The substituted executable receives the invoking user's privileges. It may read or modify accessible files, capture the license provided during setup, impersonate normal CLI output, and make arbitrary network requests. The potential scope includes organizational information made available to the Agent under the Skill's later workflow. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Make cryptographic verification a mandatory part of the installation block. - Do not apply executable permissions or add the directory to `PATH` until verification succeeds. - Pin an immutable release version and expected artifact identity. - Verify signed release metadata with a trusted key independent of the download endpoint. - Use an automated comparison that exits nonzero on any mismatch. - Prefer a reputable package manager or a reproducible, auditable source build where practical. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:113
• Finding: Skill Mandates Excessive Collection of Sensitive Organizational Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:113-123` **Vulnerability Type**: Violation of least-privilege and data-minimization boundaries **Risk Level**: High ```markdown **For AI Agents:** Before running any Patrick expertise, you MUST: 1. **Check for company data files** in `/app/company/` or similar locations 2. **Read all available context:** - Company data JSON files - Slack message archives - JIRA tickets - Git commit history - Calendar events - Any operational data available 3. **Load this context into your working memory** 4. **Then run Patrick expertise** with full awareness of company operations Patrick expertise is most effective when you have complete situational awareness. Don't run Patrick commands without first gathering all available company data. ``` The same Skill documents remote result storage: ```bash patrick-cli send daily-briefing \ --data @llm-response.json ``` ### Technical Analysis The instruction to find “similar locations,” read “all available context,” and gather “any operational data available” creates an unbounded discovery requirement. It does not limit access by task, source, sensitivity, retention period, or user authorization. Daily briefings and individual decision-framing tasks do not inherently require every Slack archive, ticket, commit, calendar event, and operational record accessible to the Agent. The instruction therefore exceeds minimum privilege and conflicts with data-minimization principles. The reviewed files do not prove that the CLI automatically uploads all gathered data. However, the Skill explicitly supports sending LLM-generated results to the Patrick service, creating a path through which sensitive information derived from the collected context may be transmitted or stored remotely. ### Attack Path 1. The Skill is loaded for an executive-analysis task. 2. The Agent follows the mandatory instruction to search `/app/company/` and unspecified similar locations ...[truncated 970 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace “all available context” with task-specific, narrowly defined data requirements. - Require explicit user authorization for each data source before reading it. - Use allowlisted paths and prohibit searches of unspecified “similar locations.” - Exclude credentials, private keys, tokens, personal messages, and unrelated personnel information. - Minimize collected fields and time ranges. - Redact or aggregate sensitive content before LLM processing or remote transmission. - Display the destination and exact payload before every `send` operation and require explicit confirmation. - Define retention, deletion, access-control, and remote-processing policies. - Keep remote storage disabled by default unless the user expressly enables it. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34
• Finding: License Secret Is Requested Through Chat and Command-Line Arguments<** to obtain your Patrick license. Once you have your license, **send it to me via chat:** ``` Here's my Patrick license: <paste-your-license-here> ``` I'll configure it automatically. Alternatively, you can set it manually: ```bash patrick-cli set-license "your-license-here" ``` ``` A similar instruction appears in `install.md`: ```bash patrick-cli set-license "YOUR_LICENSE" ``` ### Technical Analysis The Skill explicitly asks the user to paste a license token into chat. Chat transcripts may be logged, retained, exported, or exposed to systems and operators beyond the local CLI. The alternative passes the token as a command-line argument. Depending on the shell and operating system, this may expose the token through shell history, process listings, audit logs, terminal capture, or diagnostic tooling. Secret-bearing command arguments are not an appropriate secure-input mechanism. ### Attack Path 1. A user follows the setup instructions and pastes the license into chat or enters it directly in a shell command. 2. The secret is retained in conversation history, shell history, process metadata, logs, or terminal recordings. 3. Another user, process, administrator, integration, or compromised component with access to those records retrieves the token. 4. The token is reused to authenticate as the licensed customer until it expires or is revoked. ### Impact Assessment Exposure may allow unauthorized use of the associated Patrick account or licensed functionality and may reveal customer identity information encoded in the token. The exact account privileges and token lifetime cannot be determined from the reviewed files. This issue does not by itself grant operating-system privileges. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Never request that users paste license tokens into chat. - Accept the token through masked interactive standard input or a dedicated secret-management integration. - Avoid placing secrets in command-line arguments. - Store the license in a file with restrictive permissions, such as owner read/write only. - Prevent token values from appearing in normal or debug logs. - Document expiration, rotation, and revocation procedures. - Warn users to rotate any token previously disclosed through chat or shell history. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is expertise-library access, but the documented workflow also installs a remote binary, performs updates, renewals, and operational setup. This mismatch is dangerous because users or agents may trust the skill as low-risk knowledge access while it actually introduces code execution and system modification behavior.

External Script Fetching

High

• Category: Supply Chain

Content

Or install directly via curl:

```bash
curl -fsSL https://portal.patrickbot.io/downloads/latest/install.sh | bash
```

This will download patrick-cli for your platform, verify its SHA256 checksum, and place it in `$PATRICK_DATA_PATH/bin/patrick-cli` (default: `~/.patrick/bin/`). The Dockerfile and run.sh add this to PATH automatically, so you can call `patrick-cli` directly.

• Confidence: 99% confidence
• Finding: The skill recommends piping a remotely fetched script directly into bash, which gives immediate execution control to the remote endpoint and any attacker who can compromise it or the delivery path. Although the text claims checksum verification, that assurance is itself part of the untrusted script being executed, so it does not mitigate the core risk.

Chaining Abuse

High

• Category: Tool Misuse

Content

Or install directly via curl:

```bash
curl -fsSL https://portal.patrickbot.io/downloads/latest/install.sh | bash
```

This will download patrick-cli for your platform, verify its SHA256 checksum, and place it in `$PATRICK_DATA_PATH/bin/patrick-cli` (default: `~/.patrick/bin/`). The Dockerfile and run.sh add this to PATH automatically, so you can call `patrick-cli` directly.

• Confidence: 99% confidence
• Finding: The use of shell chaining with '| bash' is a classic command-chaining abuse pattern because it combines network retrieval and execution into a single opaque step. In this skill's context, that is especially dangerous because the skill already lacks tight tool scoping and presents itself as a knowledge-access utility, making unsafe execution more likely to be trusted.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill explicitly asks the user to paste a license token into chat, which exposes a credential to the conversational channel and any downstream logging, retention, or model-processing systems. Credential collection through chat is unsafe even if intended for convenience, because the token may be replayed or leaked.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Instructing users to paste the Patrick license directly into chat is direct secret exfiltration into an untrusted interface. Because licenses authenticate API access, disclosure can enable account misuse, unauthorized server access, or subscription abuse.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation tells agents to read broad internal data sources without any privacy, authorization, or necessity guardrails. This is dangerous because it normalizes excessive data access and may cause sensitive communications, tickets, calendars, or source history to be collected and processed without proper approval.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The instruction to read all available company context and load it into working memory encourages mass aggregation of potentially sensitive internal data unrelated to a specific request. This substantially increases the risk of overcollection, unintended disclosure, cross-task leakage, and transmission of confidential information to external services.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Solution**: Delete the corrupted file and regenerate the data:

```bash
rm ~/.patrick/data/storage_key.json
# Re-run the command that generates this data
```

• Confidence: 85% confidence
• Finding: The documented use of rm deletes a fixed file under the user's home directory and is presented as troubleshooting, not obvious malicious wiping. However, destructive shell commands in skill documentation remain risky because agents may execute them automatically or users may adapt them incorrectly, causing data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

curl -fL "https://portal.patrickbot.io/downloads/latest/patrick-skill.tar.gz" -o /tmp/patrick-skill.tar.gz
mkdir -p ~/new_skill/patrick
tar xzf /tmp/patrick-skill.tar.gz -C ~/new_skill/patrick
rm /tmp/patrick-skill.tar.gz
```

Then install the skill in your agent:

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "Error: Checksum mismatch!"
            echo "  Expected: $EXPECTED"
            echo "  Got:      $ACTUAL"
            rm -f "$INSTALL_DIR/patrick-cli"
            rm -f "$CHECKSUMS"
            exit 1
        fi

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents shell-based installation and command execution but does not declare any tool scope or allowed-tools boundary. That omission increases the chance an agent may execute shell commands without explicit review, especially because the skill includes installation, upgrade, renewal, and file-deletion operations.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill presents itself as expertise-library access, yet it also stores user outputs back to Patrick and directs recurring cron-based operations including license renewal and scheduled fetches. This broadens the behavior from retrieval into persistence and automation, increasing privacy, integrity, and operational risk beyond what the description suggests.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs agents to gather broad company data sources such as Slack, JIRA, commits, calendars, and operational files before use, which exceeds the narrow purpose of fetching expertise templates. This creates unnecessary data exposure and greatly expands the accessible sensitive surface area without clear need, consent, or minimization.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The install instructions direct the user/agent to download a remote executable and a tarball, place them in persistent locations, and install them into the agent environment. Although checksums are mentioned for the CLI, there is no explicit warning that these actions modify the system and require trusting the remote source, and the skill package itself is extracted and installed without an equivalent integrity-verification step.

Session Persistence

Medium

• Category: Rogue Agent

Content

Pick the binary for your platform and install it:

```bash
mkdir -p ~/.patrick/bin
curl -fL "https://portal.patrickbot.io/downloads/latest/patrick-cli-linux-x86_64" -o ~/.patrick/bin/patrick-cli
chmod +x ~/.patrick/bin/patrick-cli
export PATH="$HOME/.patrick/bin:$PATH"

• Confidence: 82% confidence
• Finding: The instructions install a binary into ~/.patrick/bin and modify PATH, creating a persistent executable foothold in future sessions. Persistence is expected for software installation, but in an agent-skill setting it still expands the long-term trusted codebase and therefore carries security significance if the binary is compromised or later abused.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
curl -fL "https://portal.patrickbot.io/downloads/latest/patrick-skill.tar.gz" -o /tmp/patrick-skill.tar.gz
mkdir -p ~/new_skill/patrick
tar xzf /tmp/patrick-skill.tar.gz -C ~/new_skill/patrick
rm /tmp/patrick-skill.tar.gz
```

• Confidence: 84% confidence
• Finding: The instructions extract a downloaded archive into a persistent skill directory and then install/copy it into the agent's skill path, making the capability durable across future runs. In context this is expected installation behavior, but it still creates persistent trust in remotely sourced content and so is a valid security concern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions ask for a license to be pasted directly into a command and stored, but do not clearly label the license as sensitive credential material. This increases the risk of accidental disclosure through chat logs, shell history, terminal recordings, process listings, or agent memory/tool logs.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly encourages the agent to ask a human for a license and then reuse it directly in a command. In an agent context, this trains credential collection behavior and can cause secrets to be exposed to the model context, logs, downstream tools, or reused outside the user's intent.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

## What's Next

Once installed, see the full skill documentation in `~/new_skill/patrick/SKILL.md` for:
- Available commands (`list`, `fetch`, `send`, `get`, `renew`)
- How to use expertise with LLMs
- Cronjob setup for daily briefings

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.