Codeline Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 0.1.0

Overview

The skill is coherent for managing Codeline, but its setup asks users to run mutable external installers and then use an API token for e-commerce data without enough scoping or safety guidance.

Install only if you trust the Codeline CLI source and are comfortable reviewing or replacing the setup steps with pinned, verified installs. Use a least-privilege, revocable Codeline token, avoid production tokens unless necessary, and confirm the exact commands before listing users/orders or creating coupons.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Unverified Remote Installer Is Executed Directly Through Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash

bun --version || curl -fsSL https://bun.sh/install | bash

Technical Analysis

When Bun is unavailable, the command retrieves a mutable installation script from https://bun.sh/install and pipes it directly into Bash. The downloaded content is not pinned to a version, saved for inspection, or validated with a cryptographic checksum or signature.

The domain is associated with the Bun project, but transport security alone does not establish that the returned script is the exact artifact reviewed by the Skill author. Compromise of the upstream website, CDN, release process, DNS path, or TLS endpoint could change the effective payload after this Skill has been reviewed.

Executing an installer is relevant to establishing the documented CLI environment, but immediate curl | bash execution is not the minimum privilege or minimum-risk mechanism required. Bun could instead be declared as a prerequisite or installed from a pinned and independently verified artifact.

Attack Path

1. A user or agent follows the setup instructions on a system where bun is unavailable or not in PATH.
2. The bun --version command fails, causing the shell to execute the right-hand side of ||.
3. curl downloads the current response from https://bun.sh/install.
4. The response is passed directly to Bash without integrity or authenticity verification beyond HTTPS.
5. If the upstream response has been compromised, attacker-controlled shell commands execute immediately.
6. Those commands can modify files, install additional payloads, alter shell configuration, or access data available to the invoking account.

Impact Assessment

The remote script executes with all privileges of the user running the setup command. In a typical non-root environment, thi ...[truncated 497 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | bash pipeline and document Bun as an explicit prerequisite where practical.
• Prefer the operating system's trusted package manager or another controlled installation mechanism.
• If direct artifact installation is necessary:
  1. Pin an exact Bun release version.
  2. Download the installer or release artifact to a local file.
  3. Verify a publisher signature or a SHA-256 checksum obtained through an independently trusted channel.
  4. Inspect or constrain the downloaded installer before execution.
  5. Run it as an unprivileged user and document all files and configuration it modifies.
• Fail closed when verification cannot be completed.
• Avoid recommending elevated execution such as sudo unless a separately justified operation strictly requires it.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11

Finding

Mutable npm and GitHub Sources Create an Unpinned Supply-Chain Execution Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-20
Vulnerability Type: Insecure third-party dependency installation
Risk Level: High

Complete Code Snippets:

bash

npx api2cli install Melvynx/codeline-cli

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle codeline
npx api2cli link codeline

Technical Analysis

The setup invokes api2cli through npx without specifying an exact package version or integrity value. Depending on the local environment and npm behavior, npx can retrieve and execute the currently published package. The GitHub source Melvynx/codeline-cli is also referenced without a reviewed commit hash or signed release identifier.

This creates a transitive execution chain in which both the package performing installation and the repository content being installed may change after audit. A compromised npm package, maintainer account, repository, or future malicious release could introduce arbitrary behavior during installation, bundling, linking, or later CLI invocation.

The link operation also affects command resolution by making the generated CLI available through ~/.local/bin. Although this supports the declared functionality, it increases the consequence of supply-chain compromise because attacker-controlled executable content could be placed on a user-accessible command path. The Skill provides no version lock, checksum, signature verification, or reproducible-build control.

Attack Path

1. An attacker compromises the api2cli npm package, its publisher account, or an unpinned dependency, or compromises the referenced GitHub repository.
2. The attacker publishes a modified package or changes repository content while retaining the expected package or repository name.
3. A user or agent runs npx api2cli install Melvynx/codeline-cli.
4. The mutable package executes and retrieves or processes mutable repository content. ...[truncated 1250 chars]

Remediation

View remediation

Remediation Suggestions

• Pin api2cli to an exact, audited version rather than invoking an unconstrained package name.
• Use a lockfile or equivalent integrity metadata and verify the npm package's expected cryptographic integrity.
• Pin Melvynx/codeline-cli to a reviewed commit hash or a signed, immutable release.
• Verify release signatures or published checksums before installation and bundling.
• Prefer reproducible, prebuilt artifacts from a controlled release process instead of dynamically building mutable repository content.
• Review package lifecycle scripts and disable unnecessary install-time scripts where supported.
• Avoid automatic PATH modification where possible; otherwise, disclose and validate the exact linked executable path.
• Ensure the installed executable and parent directories are not writable by less-trusted users.
• Obtain explicit user approval before storing an API token, and issue a least-privileged, revocable token limited to required Codeline resources and operations.
• Document dependency provenance and establish a process for reviewing and updating pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill tells users to execute curl -fsSL https://bun.sh/install | bash, which downloads a remote script and pipes it directly into a shell without inspection or integrity verification. This is a classic remote code execution and supply-chain pattern: if the source, transport, or hosting is compromised, arbitrary code runs immediately on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

If codeline-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle codeline
npx api2cli link codeline

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | bash construct enables command chaining that executes downloaded content immediately, removing opportunities for review and amplifying the consequences of a compromised upstream script. In the setup context of a privileged local development environment, this makes exploitation straightforward and high impact.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

If codeline-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle codeline
npx api2cli link codeline

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description uses broad triggers such as products, orders, users, and coupons, which can match many unrelated conversations and cause the skill to activate unexpectedly. In this skill, accidental activation is more dangerous because the available commands access customer, order, and coupon-management functions in an e-commerce context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill instructs users to run npx api2cli install Melvynx/codeline-cli without pinning a specific package or commit version, which creates a supply-chain risk. If the upstream package or resolution target changes, a malicious or compromised release could be executed during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

npx api2cli bundle codeline relies on an unpinned api2cli binary, so execution behavior may change over time or be influenced by a compromised upstream release. In a skill that prepares tooling for API access, this increases the chance of running unexpected code during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

npx api2cli link codeline again executes an unpinned external tool, introducing avoidable supply-chain exposure. Because this step modifies the local environment by linking binaries into the user's PATH, compromise could have persistence or broader workstation impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The authentication section instructs users to set an auth token and test access, but it provides no warnings about secret handling or the sensitivity of customer, order, and user data exposed by the CLI. In an e-commerce/admin skill, this omission increases the risk of token leakage, overbroad use, and unintentional access to personal or transactional information.

Content

No source excerpt is available for this finding.