Security audit

Patrick bot

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent business purpose, but it asks for broad company-data access, insecure license handling, and installation of mutable remote executables.

Review before installing. Only use this skill if you trust the Patrick publisher and service with executive and company context. Do not paste license tokens into chat; use a local secret mechanism instead. Avoid the curl-to-bash/latest install path, require pinned signed artifacts, and approve each company data source explicitly before letting an agent read or send results.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:24
Finding: Mutable Remote Installer Is Executed Directly Through a Shell
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:39
Finding: Downloaded CLI Binary Uses Fail-Open Integrity Verification
Content: View full analysis
/dev/null; then curl -fL "${BASE_URL}/${BINARY_NAME}" -o "$INSTALL_DIR/patrick-cli" elif command -v wget &> /dev/null; then wget "${BASE_URL}/${BINARY_NAME}" -O "$INSTALL_DIR/patrick-cli" else echo "Error: Neither curl nor wget found. Please install one of them." exit 1 fi # Verify SHA256 checksum echo "Verifying checksum..." CHECKSUMS=$(mktemp) if command -v curl &> /dev/null; then curl -fsSL "${BASE_URL}/checksums-sha256.txt" -o "$CHECKSUMS" elif command -v wget &> /dev/null; then wget -q "${BASE_URL}/checksums-sha256.txt" -O "$CHECKSUMS" fi if [ -s "$CHECKSUMS" ]; then EXPECTED=$(grep "$BINARY_NAME" "$CHECKSUMS" | awk '{print $1}') if [ -n "$EXPECTED" ]; then if command -v sha256sum &> /dev/null; then ACTUAL=$(sha256sum "$INSTALL_DIR/patrick-cli" | awk '{print $1}') elif command -v shasum &> /dev/null; then ACTUAL=$(shasum -a 256 "$INSTALL_DIR/patrick-cli" | awk '{print $1}') else echo "Warning: No sha256sum or shasum found, skipping checksum verification" ACTUAL="$EXPECTED" fi if [ "$EXPECTED" != "$ACTUAL" ]; then echo "Error: Checksum mismatch!" echo " Expected: $EXPECTED" echo " Got: $ACTUAL" rm -f "$INSTALL_DIR/patrick-cli" rm -f "$CHECKSUMS" exit 1 fi echo " Checksum verified OK" else echo " Warning: Binary not found in checksums file, skipping verificatio ...[truncated 2168 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: install.md:53
Finding: Manual Installation Makes a Remote Binary Executable Without Enforced Verification
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:113
Finding: Skill Mandates Excessive Collection of Sensitive Organizational Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:34
Finding: License Secret Is Requested Through Chat and Command-Line Arguments
Content: View full analysis
``` I'll configure it automatically. Alternatively, you can set it manually: ```bash patrick-cli set-license "your-license-here" ``` ``` A similar instruction appears in `install.md`: ```bash patrick-cli set-license "YOUR_LICENSE" ``` ### Technical Analysis The Skill explicitly asks the user to paste a license token into chat. Chat transcripts may be logged, retained, exported, or exposed to systems and operators beyond the local CLI. The alternative passes the token as a command-line argument. Depending on the shell and operating system, this may expose the token through shell history, process listings, audit logs, terminal capture, or diagnostic tooling. Secret-bearing command arguments are not an appropriate secure-input mechanism. ### Attack Path 1. A user follows the setup instructions and pastes the license into chat or enters it directly in a shell command. 2. The secret is retained in conversation history, shell history, process metadata, logs, or terminal recordings. 3. Another user, process, administrator, integration, or compromised component with access to those records retrieves the token. 4. The token is reused to authenticate as the licensed customer until it expires or is revoked. ### Impact Assessment Exposure may allow unauthorized use of the associated Patrick account or licensed functionality and may reveal customer identity information encoded in the token. The exact account privileges and token lifetime cannot be determined from the reviewed files. This issue does not by itself grant operating-system privileges. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The stated purpose is expertise-library access, but the documented workflow also installs a remote binary, performs updates, renewals, and operational setup. This mismatch is dangerous because users or agents may trust the skill as low-risk knowledge access while it actually introduces code execution and system modification behavior.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skill recommends piping a remotely fetched script directly into bash, which gives immediate execution control to the remote endpoint and any attacker who can compromise it or the delivery path. Although the text claims checksum verification, that assurance is itself part of the untrusted script being executed, so it does not mitigate the core risk.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
Or install directly via curl:

bash
curl -fsSL https://portal.patrickbot.io/downloads/latest/install.sh | bash

This will download patrick-cli for your platform, verify its SHA256 checksum, and place it in $PATRICK_DATA_PATH/bin/patrick-cli (default: ~/.patrick/bin/). The Dockerfile and run.sh add this to PATH automatically, so you can call patrick-cli directly.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The use of shell chaining with '| bash' is a classic command-chaining abuse pattern because it combines network retrieval and execution into a single opaque step. In this skill's context, that is especially dangerous because the skill already lacks tight tool scoping and presents itself as a knowledge-access utility, making unsafe execution more likely to be trusted.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
Or install directly via curl:

bash
curl -fsSL https://portal.patrickbot.io/downloads/latest/install.sh | bash

This will download patrick-cli for your platform, verify its SHA256 checksum, and place it in $PATRICK_DATA_PATH/bin/patrick-cli (default: ~/.patrick/bin/). The Dockerfile and run.sh add this to PATH automatically, so you can call patrick-cli directly.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly asks the user to paste a license token into chat, which exposes a credential to the conversational channel and any downstream logging, retention, or model-processing systems. Credential collection through chat is unsafe even if intended for convenience, because the token may be replayed or leaked.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Instructing users to paste the Patrick license directly into chat is direct secret exfiltration into an untrusted interface. Because licenses authenticate API access, disclosure can enable account misuse, unauthorized server access, or subscription abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation tells agents to read broad internal data sources without any privacy, authorization, or necessity guardrails. This is dangerous because it normalizes excessive data access and may cause sensitive communications, tickets, calendars, or source history to be collected and processed without proper approval.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction to read all available company context and load it into working memory encourages mass aggregation of potentially sensitive internal data unrelated to a specific request. This substantially increases the risk of overcollection, unintended disclosure, cross-task leakage, and transmission of confidential information to external services.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: The documented use of rm deletes a fixed file under the user's home directory and is presented as troubleshooting, not obvious malicious wiping. However, destructive shell commands in skill documentation remain risky because agents may execute them automatically or users may adapt them incorrectly, causing data loss.
Content: Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.
Solution: Delete the corrupted file and regenerate the data:

bash
rm ~/.patrick/data/storage_key.json # Re-run the command that generates this data

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · install.md (reported line 75)May include surrounding context.
curl -fL "https://portal.patrickbot.io/downloads/latest/patrick-skill.tar.gz" -o /tmp/patrick-skill.tar.gz mkdir -p ~/new_skill/patrick tar xzf /tmp/patrick-skill.tar.gz -C ~/new_skill/patrick rm /tmp/patrick-skill.tar.gz

text
Then install the skill in your agent:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · install.sh (reported line 79)May include surrounding context.
sh
echo "Error: Checksum mismatch!" echo " Expected: $EXPECTED" echo " Got: $ACTUAL" rm -f "$INSTALL_DIR/patrick-cli" rm -f "$CHECKSUMS" exit 1 fi

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents shell-based installation and command execution but does not declare any tool scope or allowed-tools boundary. That omission increases the chance an agent may execute shell commands without explicit review, especially because the skill includes installation, upgrade, renewal, and file-deletion operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill presents itself as expertise-library access, yet it also stores user outputs back to Patrick and directs recurring cron-based operations including license renewal and scheduled fetches. This broadens the behavior from retrieval into persistence and automation, increasing privacy, integrity, and operational risk beyond what the description suggests.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs agents to gather broad company data sources such as Slack, JIRA, commits, calendars, and operational files before use, which exceeds the narrow purpose of fetching expertise templates. This creates unnecessary data exposure and greatly expands the accessible sensitive surface area without clear need, consent, or minimization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The install instructions direct the user/agent to download a remote executable and a tarball, place them in persistent locations, and install them into the agent environment. Although checksums are mentioned for the CLI, there is no explicit warning that these actions modify the system and require trusting the remote source, and the skill package itself is extracted and installed without an equivalent integrity-verification step.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 82% confidence
Finding: The instructions install a binary into ~/.patrick/bin and modify PATH, creating a persistent executable foothold in future sessions. Persistence is expected for software installation, but in an agent-skill setting it still expands the long-term trusted codebase and therefore carries security significance if the binary is compromised or later abused.
Content: Scanner excerpt · install.md (reported line 54)May include surrounding context.
Pick the binary for your platform and install it:

bash
mkdir -p ~/.patrick/bin curl -fL "https://portal.patrickbot.io/downloads/latest/patrick-cli-linux-x86_64" -o ~/.patrick/bin/patrick-cli chmod +x ~/.patrick/bin/patrick-cli export PATH="$HOME/.patrick/bin:$PATH"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The instructions extract a downloaded archive into a persistent skill directory and then install/copy it into the agent's skill path, making the capability durable across future runs. In context this is expected installation behavior, but it still creates persistent trust in remotely sourced content and so is a valid security concern.
Content: Scanner excerpt · install.md (reported line 73)May include surrounding context.
bash
curl -fL "https://portal.patrickbot.io/downloads/latest/patrick-skill.tar.gz" -o /tmp/patrick-skill.tar.gz mkdir -p ~/new_skill/patrick tar xzf /tmp/patrick-skill.tar.gz -C ~/new_skill/patrick rm /tmp/patrick-skill.tar.gz

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions ask for a license to be pasted directly into a command and stored, but do not clearly label the license as sensitive credential material. This increases the risk of accidental disclosure through chat logs, shell history, terminal recordings, process listings, or agent memory/tool logs.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly encourages the agent to ask a human for a license and then reuse it directly in a command. In an agent context, this trains credential collection behavior and can cause secrets to be exposed to the model context, logs, downstream tools, or reused outside the user's intent.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · install.md (reported line 116)May include surrounding context.
md
## What's Next Once installed, see the full skill documentation in `~/new_skill/patrick/SKILL.md` for: - Available commands (`list`, `fetch`, `send`, `get`, `renew`) - How to use expertise with LLMs - Cronjob setup for daily briefings

Static analysis

No suspicious patterns detected.