Competitive Intel

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent competitive-research purpose, but its installation and activation scope deserve Review before use.

Install only if you are comfortable using Bright Data for live web scraping and logging in to its CLI. Do not run the provided curl-to-bash installer blindly; prefer an official signed or package-manager install path, or download and verify the installer before executing it. Consider narrowing use to explicit live competitive-research requests.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:23

Finding

Unverified Remote Installer Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–26
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Vulnerable Code Snippet:

bash

1. Bright Data CLI installed:
   ```bash
   curl -fsSL https://cli.brightdata.com/install.sh | bash
   ```

Technical Analysis

The installation command downloads a shell script from an external URL and passes the response directly to Bash. The retrieved payload is not version-pinned, saved for inspection, or verified through a cryptographic signature or pinned checksum.

Consequently, the code executed during installation can differ from the code present when this Skill was reviewed. The cli.brightdata.com hostname appears related to the Skill's declared Bright Data dependency, but the audited project provides no evidence establishing the remote script's contents or integrity. A legitimate vendor hostname does not eliminate risks arising from compromised hosting, DNS or delivery infrastructure, vendor accounts, or future changes to the installer.

Installing the required CLI is related to the Skill's competitive-intelligence functionality. However, immediately executing mutable remote content exceeds the minimum-risk mechanism necessary to install that dependency.

Attack Path

1. A user requests competitive-intelligence functionality that depends on the Bright Data CLI.
2. The Agent or user follows the prerequisite installation instructions in SKILL.md.
3. curl retrieves the current response from https://cli.brightdata.com/install.sh.
4. The response is streamed directly into Bash without inspection or integrity verification.
5. If the remote installer or its delivery path has been compromised or maliciously changed, attacker-controlled shell commands execute with the invoking user's privileges.
6. Those commands can access resources available to that account and may download further payloads, alter ...[truncated 1010 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the curl | bash pipeline with a version-pinned installation from an authenticated official package repository.
2. If a shell installer is unavoidable:
   • Download it to a local file without executing it.
   • Pin the expected release version and immutable URL.
   • Verify a vendor-provided cryptographic signature and a trusted, pinned SHA-256 digest.
   • Inspect the script before execution.
   • Require explicit user approval before running it.
3. Run installation as an ordinary user and prohibit unnecessary sudo or root execution.
4. Document the installer’s expected filesystem changes, network destinations, permissions, and authentication state.
5. Prefer a sandboxed or otherwise restricted execution environment for third-party installation.
6. Fail closed when signature or checksum verification is unavailable or unsuccessful.
7. Periodically review and update the pinned version and digest through a controlled dependency-update process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The documentation tells the agent/user to install software by piping a remote script directly into bash, which executes code from the network without inspection or integrity verification. If the remote host, transport, or script is compromised, this becomes arbitrary code execution on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

1. Bright Data CLI installed:

   bash

   curl -fsSL https://cli.brightdata.com/install.sh | bash
   

2. One-time login completed:

   bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The explicit use of '| bash' is a classic command-chaining antipattern that turns fetched remote content into immediately executed shell commands. In an agent skill context, this is especially risky because operational instructions may be copied verbatim into execution environments, enabling compromise with minimal user scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

1. Bright Data CLI installed:

   bash

   curl -fsSL https://cli.brightdata.com/install.sh | bash
   

2. One-time login completed:

   bash

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises itself for a very broad class of competitive-research requests, which increases the chance it will be auto-invoked in situations where the user did not explicitly consent to live external collection. Because the skill mandates gathering live data first, broad triggering can cause unexpected web scraping, third-party queries, and data transfer outside the assistant’s normal response path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill strongly instructs the agent to 'always gather live data first' but does not present a clear user-facing warning that it will contact external services and scrape websites. This undermines informed consent and can surprise users who expected an internal knowledge response rather than live collection via Bright Data infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger table uses generic phrases like 'Tell me about [company]' and 'Who are the players,' which are broad enough to capture ordinary informational queries. In this skill, accidental activation is more dangerous because the workflow instructs the agent to always perform external data gathering, creating unnecessary outbound requests and possible privacy or policy issues.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.