T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:15- Finding
Remote Bun Installer Is Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
api2cli
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent API-to-CLI purpose, but it asks agents to run mutable remote installers and unpinned package commands while also linking tools and publishing content publicly.
Review this skill carefully before installing. Only run it in a development environment where you are comfortable with shell execution, package installs, PATH changes, skill symlinks, and public publishing. Prefer pinned package versions, avoid `curl | bash`, inspect generated code and README files for secrets, and require explicit confirmation before linking into agents or publishing to GitHub, npm, ClawHub, Sundial Hub, or api2cli.dev.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/openclaw.md:9- Finding
OpenClaw Setup Prompt Instructs the Agent to Execute a Mutable Remote Installer
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:10- Finding
Unpinned npm Packages Are Automatically Retrieved and Executed
- Content
View full analysis
``` ```bash npx api2cli install ``` Related setup instructions include: ```text 2. Install api2cli: npm i -g api2cli 3. Install the api2cli skill from ClawHub: npx clawhub install api2cli 4. Link the skill to OpenClaw: npx api2cli link --all --openclaw 5. Verify: npx api2cli --help ``` ### Technical Analysis The Skill mandates `npx api2cli` without specifying an exact version or integrity value. Depending on local npm state, `npx` can retrieve the currently resolved registry release and execute its package code. The effective implementation is therefore external to this audited project and can change after review. The risk extends beyond one command. The documented `api2cli install` operation clones, builds, links to `PATH`, and symlinks third-party Skill content into agent directories. Thus, compromise of an npm package, maintainer account, registry entry, GitHub repository, or registry-selected CLI can progress from dependency resolution to local execution and automatic agent discovery. The network, shell, and filesystem permissions declared in `claw.json` support the legitimate generation workflow, but they substantially increase the impact of an unsafe dependency resolution. ### Attack Path 1. The agent follows the instruction to always invoke `npx api2cli`. 2. npm resolves an unpinned current package release. 3. A compromised maintainer account, package release, registry response, or dependency supplies malicious code. 4. `npx` ...[truncated 1195 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (85)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The prerequisite command downloads a remote script with
curland pipes it directly tobash, executing unauthenticated content from the network without prior inspection. This is a classic remote code execution pattern and is especially dangerous in an agent skill because the instruction may be followed automatically in a setup flow.- Content
Prerequisites
bash bun --version || curl -fsSL https://bun.sh/install | bashWorkflow
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashconstruct chains network retrieval directly into shell execution, eliminating any opportunity to inspect or validate the fetched content before it runs. In the context of an agent skill, this pattern sharply increases the chance of automatic compromise from a transient CDN, DNS, MITM, or upstream package-site breach.- Content
Prerequisites
bash bun --version || curl -fsSL https://bun.sh/install | bashWorkflow
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
curl -fsSL https://bun.sh/install | bashfetches a remote script and pipes it directly to the shell, giving the remote endpoint immediate arbitrary code execution on the host. This is especially dangerous in a copy-paste setup for agent users because it bypasses inspection, couples transport trust to code execution, and can lead to full system compromise if the script source or delivery path is malicious.- Content
text Set up api2cli for me: 1. Install bun if missing: bun --version || curl -fsSL https://bun.sh/install | bash 2. Install api2cli: npm i -g api2cli 3. Install the api2cli skill from ClawHub: npx clawhub install api2cli 4. Link the skill to OpenClaw: npx api2cli link --all --openclaw
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashchaining pattern turns remote content into immediate shell execution with no review step. In this document, it appears inside a one-shot setup prompt intended for an agent workflow, which materially increases the likelihood that dangerous code is run automatically or with minimal human oversight.- Content
text Set up api2cli for me: 1. Install bun if missing: bun --version || curl -fsSL https://bun.sh/install | bash 2. Install api2cli: npm i -g api2cli 3. Install the api2cli skill from ClawHub: npx clawhub install api2cli 4. Link the skill to OpenClaw: npx api2cli link --all --openclaw
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The prescribed
git push -u origin <branch> --forceuses a high-risk parameter that can overwrite remote history and bypass normal safety expectations. In this skill context, the command appears in a recovery path after push protection or remote issues, making it especially dangerous because users may execute it quickly to unblock publishing without validating the remote state.- Content
gh repo create -cli --public --source=. --push --description ""
text - If `gh repo create` succeeds but push fails (e.g. push protection), fix the issue per Phase 2 and run `git push -u origin <branch> --force`. - If `gh repo create` says "unable to add remote" (remote already exists), just push: `git push -u origin <branch>`. - If the repo name is taken, ask the user for an alternative name.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description contains very broad trigger phrases like 'create a CLI for X', 'wrap this API', 'publish to npm', and 'push to github', which can cause accidental invocation on common development requests. In an agent context, overbroad activation is dangerous because it may pull the workflow into code generation, installation, linking, or publishing actions the user did not explicitly intend.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill repeatedly instructs the agent to execute
npx api2cliwithout pinning a specific package version or integrity hash. Becausenpxresolves and executes code from the registry at runtime, a compromised maintainer account, dependency hijack, or malicious new release could cause arbitrary code execution on the user's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This instruction fetches and executes
api2clivianpxwith no version pinning, which means the executed code can change over time without review. In an agent skill, that is especially risky because the agent may automatically run the command as part of a workflow, turning a supply-chain compromise into code execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The unpinned
npx api2cli install <name>command executes code obtained dynamically from the package registry. If the package or one of its dependencies is compromised, the skill becomes a vehicle for arbitrary command execution and potentially further installation of untrusted tooling.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 69% confidence
- Finding
The workflow creates a scaffold under
~/.cli/<app>-cli/..., establishing durable artifacts in the user's home directory that can later be executed, linked, or published. While persistence is expected for a scaffolding tool, in an agent skill this still matters because generated code and configuration can outlive the session and become a foothold for later misuse if not reviewed.- Content
Find the API docs or OpenAPI spec. Identify: base URL, auth type, auth header, all resources and endpoints.
3. Create the scaffold
bash npx api2cli create <app> --base-url <url> --auth-type bearer
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Running
npx api2cli create ...without version pinning exposes the environment to mutable registry content. Since this command scaffolds code and files that may later be built, linked, and published, a compromised release could persist malicious logic into generated artifacts.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The bundle step executes an unpinned package from the registry, creating a direct supply-chain execution path. Because bundling can process project files and produce distributable artifacts, compromise here may both execute code locally and taint outputs.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The
npx api2cli link <app>command is unpinned and modifies the user's executable environment by adding linked binaries and updating PATH behavior. That magnifies the risk of a malicious or compromised package because it can establish persistence and influence future command resolution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The
npx api2cli link <app> --openclawcommand combines unpinned remote execution with cross-tool integration, increasing blast radius if abused. A malicious package could alter local skill installations, PATH, or downstream agent behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
npx clawhub install api2cliexecutes unpinned package code fetched at runtime. That creates the same supply-chain risk as the othernpxusages, and in this context may also install additional skill content that later influences agent behavior.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill provides workflows for publishing to GitHub, npm, ClawHub, Sundial Hub, and a registry, but it does not include an explicit warning about public disclosure of source code, secrets, embedded tokens, internal URLs, or proprietary API details. In this context, that omission is materially dangerous because the skill actively guides the user toward making artifacts public.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The instruction to 'Automatically run the GitHub publish flow first' delegates a consequential external action to the agent based on its own decision about repository state. Autonomous execution of publishing-related steps can lead to unintended disclosure, creation of public repositories, or irreversible network actions without sufficiently granular user approval.
- Content
md 1. **Verify `gh` CLI is authenticated**: run `gh auth status`. If not logged in, ask the user to run `gh auth login` first. **Stop and wait.** 2. **Check if the CLI is already on GitHub**: run `git remote get-url origin` in the CLI directory. - If no remote exists → the CLI is not on GitHub yet. **Automatically run the GitHub publish flow first** (see below) before proceeding to npm or registry publish. - If a remote exists → already on GitHub, continue. #### To GitHub
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The authentication instruction uses
npx clawhub loginwithout a version pin, so the code handling credentials is mutable and registry-controlled. If compromised, it could harvest tokens or redirect authentication flows.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
Publishing via
npx clawhub publish ...executes unpinned registry code in a context that likely has access to local files and credentials. A compromised package could exfiltrate unpublished code or publish altered skill contents.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The install example
npx clawhub install <app>-cliis another unpinned remote execution path. While presented as user guidance, it normalizes execution of mutable registry code and can propagate unsafe habits into generated skills or downstream users.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The
npx sundial-hub auth statusandnpx sundial-hub auth logincommands are unpinned and operate in a credential-sensitive context. A malicious package release could capture tokens, alter login prompts, or mislead the user about authentication state.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The push command uses an unpinned
npxpackage while uploading a local skill to a public hub. This exposes both local content and credentials to any compromise in the fetched package or its dependencies.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The install example
npx sundial-hub add ...is an unpinned runtime package execution path. Even as documentation, it instructs agents or users to trust mutable code from the registry without review.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The registry install instruction
npx api2cli install <name>is unpinned and additionally causes discovery and installation of third-party CLIs. This compounds supply-chain risk by chaining trust in both the package manager invocation and the installed artifact.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description is extremely broad ('Install any REST API as a CLI') and does not meaningfully constrain when the skill should be invoked. In a skill that also requests network, shell, and filesystem permissions, this can cause over-invocation for loosely related prompts, increasing the chance that powerful actions are taken in the wrong context or on untrusted targets.
- Content