Codeline Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 0.1.0

Overview

The skill is coherent for managing Codeline, but its setup asks users to run mutable external installers and then use an API token for e-commerce data without enough scoping or safety guidance.

Install only if you trust the Codeline CLI source and are comfortable reviewing or replacing the setup steps with pinned, verified installs. Use a least-privilege, revocable Codeline token, avoid production tokens unless necessary, and confirm the exact commands before listing users/orders or creating coupons.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18
• Finding: Unverified Remote Installer Is Executed Directly Through Bash## Vulnerability Details **File Location**: `SKILL.md:18` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash bun --version || curl -fsSL https://bun.sh/install | bash ``` ### Technical Analysis When Bun is unavailable, the command retrieves a mutable installation script from `https://bun.sh/install` and pipes it directly into Bash. The downloaded content is not pinned to a version, saved for inspection, or validated with a cryptographic checksum or signature. The domain is associated with the Bun project, but transport security alone does not establish that the returned script is the exact artifact reviewed by the Skill author. Compromise of the upstream website, CDN, release process, DNS path, or TLS endpoint could change the effective payload after this Skill has been reviewed. Executing an installer is relevant to establishing the documented CLI environment, but immediate `curl | bash` execution is not the minimum privilege or minimum-risk mechanism required. Bun could instead be declared as a prerequisite or installed from a pinned and independently verified artifact. ### Attack Path 1. A user or agent follows the setup instructions on a system where `bun` is unavailable or not in `PATH`. 2. The `bun --version` command fails, causing the shell to execute the right-hand side of `||`. 3. `curl` downloads the current response from `https://bun.sh/install`. 4. The response is passed directly to Bash without integrity or authenticity verification beyond HTTPS. 5. If the upstream response has been compromised, attacker-controlled shell commands execute immediately. 6. Those commands can modify files, install additional payloads, alter shell configuration, or access data available to the invoking account. ### Impact Assessment The remote script executes with all privileges of the user running the setup command. In a typical non-root environment, thi ...[truncated 497 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` pipeline and document Bun as an explicit prerequisite where practical. - Prefer the operating system's trusted package manager or another controlled installation mechanism. - If direct artifact installation is necessary: 1. Pin an exact Bun release version. 2. Download the installer or release artifact to a local file. 3. Verify a publisher signature or a SHA-256 checksum obtained through an independently trusted channel. 4. Inspect or constrain the downloaded installer before execution. 5. Run it as an unprivileged user and document all files and configuration it modifies. - Fail closed when verification cannot be completed. - Avoid recommending elevated execution such as `sudo` unless a separately justified operation strictly requires it.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11
• Finding: Mutable npm and GitHub Sources Create an Unpinned Supply-Chain Execution Path## Vulnerability Details **File Location**: `SKILL.md:11-20` **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: High **Complete Code Snippets**: ```bash npx api2cli install Melvynx/codeline-cli ``` ```bash bun --version || curl -fsSL https://bun.sh/install | bash npx api2cli bundle codeline npx api2cli link codeline ``` ### Technical Analysis The setup invokes `api2cli` through `npx` without specifying an exact package version or integrity value. Depending on the local environment and npm behavior, `npx` can retrieve and execute the currently published package. The GitHub source `Melvynx/codeline-cli` is also referenced without a reviewed commit hash or signed release identifier. This creates a transitive execution chain in which both the package performing installation and the repository content being installed may change after audit. A compromised npm package, maintainer account, repository, or future malicious release could introduce arbitrary behavior during installation, bundling, linking, or later CLI invocation. The `link` operation also affects command resolution by making the generated CLI available through `~/.local/bin`. Although this supports the declared functionality, it increases the consequence of supply-chain compromise because attacker-controlled executable content could be placed on a user-accessible command path. The Skill provides no version lock, checksum, signature verification, or reproducible-build control. ### Attack Path 1. An attacker compromises the `api2cli` npm package, its publisher account, or an unpinned dependency, or compromises the referenced GitHub repository. 2. The attacker publishes a modified package or changes repository content while retaining the expected package or repository name. 3. A user or agent runs `npx api2cli install Melvynx/codeline-cli`. 4. The mutable package executes and retrieves or processes mutable repository content. ...[truncated 1250 chars]
• Remediation: ## Remediation Suggestions - Pin `api2cli` to an exact, audited version rather than invoking an unconstrained package name. - Use a lockfile or equivalent integrity metadata and verify the npm package's expected cryptographic integrity. - Pin `Melvynx/codeline-cli` to a reviewed commit hash or a signed, immutable release. - Verify release signatures or published checksums before installation and bundling. - Prefer reproducible, prebuilt artifacts from a controlled release process instead of dynamically building mutable repository content. - Review package lifecycle scripts and disable unnecessary install-time scripts where supported. - Avoid automatic PATH modification where possible; otherwise, disclose and validate the exact linked executable path. - Ensure the installed executable and parent directories are not writable by less-trusted users. - Obtain explicit user approval before storing an API token, and issue a least-privileged, revocable token limited to required Codeline resources and operations. - Document dependency provenance and establish a process for reviewing and updating pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

If `codeline-cli` is not found, install and build it:
```bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle codeline
npx api2cli link codeline
```

• Confidence: 98% confidence
• Finding: The skill tells users to execute `curl -fsSL https://bun.sh/install | bash`, which downloads a remote script and pipes it directly into a shell without inspection or integrity verification. This is a classic remote code execution and supply-chain pattern: if the source, transport, or hosting is compromised, arbitrary code runs immediately on the user's machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

If `codeline-cli` is not found, install and build it:
```bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle codeline
npx api2cli link codeline
```

• Confidence: 97% confidence
• Finding: The `| bash` construct enables command chaining that executes downloaded content immediately, removing opportunities for review and amplifying the consequences of a compromised upstream script. In the setup context of a privileged local development environment, this makes exploitation straightforward and high impact.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description uses broad triggers such as `products`, `orders`, `users`, and `coupons`, which can match many unrelated conversations and cause the skill to activate unexpectedly. In this skill, accidental activation is more dangerous because the available commands access customer, order, and coupon-management functions in an e-commerce context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The skill instructs users to run `npx api2cli install Melvynx/codeline-cli` without pinning a specific package or commit version, which creates a supply-chain risk. If the upstream package or resolution target changes, a malicious or compromised release could be executed during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: `npx api2cli bundle codeline` relies on an unpinned `api2cli` binary, so execution behavior may change over time or be influenced by a compromised upstream release. In a skill that prepares tooling for API access, this increases the chance of running unexpected code during setup.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: `npx api2cli link codeline` again executes an unpinned external tool, introducing avoidable supply-chain exposure. Because this step modifies the local environment by linking binaries into the user's PATH, compromise could have persistence or broader workstation impact.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The authentication section instructs users to set an auth token and test access, but it provides no warnings about secret handling or the sensitivity of customer, order, and user data exposed by the CLI. In an e-commerce/admin skill, this omission increases the risk of token leakage, overbroad use, and unintentional access to personal or transactional information.

Static analysis

No suspicious patterns detected.