Security audit

Codeline Cli

Security checks across malware telemetry and agentic risk

Overview

The skill appears to do what it claims, but it gives an agent broad authenticated access to Codeline business data and actions with weak scoping and risky setup guidance.

Install only if you trust the Codeline CLI source and need an agent to operate your Codeline account. Use a least-privileged token, avoid pasting production tokens into shared terminals or logs, confirm the exact account and command before user/order access or coupon creation, and prefer a pinned or verified installation path instead of running remote installer scripts directly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger description is broad enough to activate on generic terms like 'products', 'orders', or 'users', which are common across many unrelated contexts. Over-broad routing can cause the agent to invoke this skill unexpectedly, exposing e-commerce operations or sensitive data paths in situations where the user did not intend to interact with the Codeline system.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The authentication section instructs the user to set a token but does not warn that the command stores and subsequently uses a credential with potentially privileged API access. Without clear handling guidance, users may paste production tokens casually, store them on shared systems, or expose them in shell history and automation logs.

External Script Fetching

High

Category: Supply Chain
Content: If `codeline-cli` is not found, install and build it: ```bash bun --version || curl -fsSL https://bun.sh/install | bash npx api2cli bundle codeline npx api2cli link codeline ```
Confidence: 98% confidence
Finding: curl -fsSL https://bun.sh/install | bash

Chaining Abuse

High

Category: Tool Misuse
Content: If `codeline-cli` is not found, install and build it: ```bash bun --version || curl -fsSL https://bun.sh/install | bash npx api2cli bundle codeline npx api2cli link codeline ```
Confidence: 99% confidence
Finding: | bash

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.