ClawHub
Back to skill

Security audit

Exa Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Exa CLI helper, but its setup path asks users to run unverified remote installers and unpinned package commands that modify the command environment.

Review before installing. The Exa command examples themselves are ordinary, but do not run the setup commands as written unless you are comfortable with unpinned third-party code execution and PATH changes. Prefer a pinned, verified Exa CLI installation path and explicit approval for any environment modification.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Unverified Remote Installer Is Piped Directly Into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
bun --version || curl -fsSL https://bun.sh/install | bash

Technical Analysis

When Bun is unavailable, this command downloads a mutable script from https://bun.sh/install and immediately executes it with Bash. The downloaded content is not pinned to a version, saved for inspection, or validated using a cryptographic signature or checksum.

Although bun.sh is associated with the Bun project, piping a network response directly into a shell creates a remote code-execution channel. The executed payload can change after the Skill has been audited. Compromise of the domain, hosting infrastructure, upstream installer, or relevant TLS trust path could result in arbitrary commands being returned and executed.

Installing a runtime through an unverified remote shell script is not required for the Skill's declared web-search functionality and exceeds the minimum safe setup behavior.

Attack Path

  1. A user or agent follows the setup instructions on a system where bun is unavailable or bun --version fails.
  2. The shell evaluates the right side of the || operator.
  3. curl retrieves the current response from https://bun.sh/install.
  4. The response is passed directly to Bash without integrity or authenticity verification.
  5. If the remote response has been maliciously altered, its commands execute with the privileges of the user running the setup.
  6. The payload can access user-readable data, modify user-owned files and configuration, install additional software, or establish persistence where the user's permissions allow it.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The accessible scope includes the user's files, environment variables, credentials readable by that account, shell configurati ...[truncated 209 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation path.
  • Direct users to an approved operating-system package manager or official, independently verifiable installation mechanism.
  • If direct artifact installation is unavoidable:
    1. Pin a specific Bun release.
    2. Download the artifact to a local file without executing it.
    3. Verify its published cryptographic signature or checksum through a separately trusted channel.
    4. Inspect or approve the installer before execution.
    5. Execute it as an unprivileged user.
  • Do not install Bun automatically during normal Skill operation. Require explicit user approval for runtime installation.
  • Document the files and environment settings that the installer is expected to modify.

T08 · Insecure Dependencies

Error
Location
SKILL.md:12
Finding

Unpinned Third-Party Package and Mutable GitHub Source Are Executed During Setup

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-20
Vulnerability Type: Insecure third-party dependencies and mutable installation sources
Risk Level: High

Complete Code Snippet:

bash
npx api2cli install Melvynx/exa-cli
bash
npx api2cli bundle exa
npx api2cli link exa

Technical Analysis

The setup invokes api2cli through npx without specifying an exact package version or integrity value. Depending on local state and npx behavior, the package may be downloaded from the configured npm registry and executed. This makes the effective setup code dependent on mutable third-party package state.

The command also installs the CLI from the mutable GitHub namespace Melvynx/exa-cli without identifying a release tag, commit hash, signature, or checksum. Consequently, code published or changed after this audit may be installed and bundled.

Finally, npx api2cli link exa makes the generated CLI available through the user's command environment. The document states that this operation adds ~/.local/bin to PATH, which changes subsequent command resolution. While linking a CLI is related to setup, performing it through unpinned tooling increases the consequences of a supply-chain compromise.

Attack Path

  1. An attacker compromises the api2cli npm package, its publisher account, the configured package registry, or the referenced GitHub repository.
  2. The attacker publishes malicious package code or modifies the mutable CLI source.
  3. A user or agent follows the documented setup commands without a locally trusted pinned copy.
  4. npx resolves and executes the compromised api2cli package.
  5. The installer retrieves or processes the compromised GitHub source.
  6. The bundling or linking operation creates a malicious executable and exposes it through the user's command search path.
  7. Later invocations of exa-cli can execute attacker-controlled logic while appearing to be legitimate Exa operations.

Impact

...[truncated 725 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin api2cli to an exact reviewed version rather than resolving an unspecified latest version.
  • Enforce npm integrity verification and use a trusted lockfile or equivalent dependency manifest.
  • Pin Melvynx/exa-cli to a specific reviewed release or immutable commit hash.
  • Verify release signatures or published checksums before bundling or installation.
  • Prefer an official Exa-maintained distribution channel where one is available.
  • Avoid silently modifying PATH; require explicit user approval and document the exact configuration file changed.
  • Install and run the CLI as an unprivileged user in an isolated environment.
  • Review dependency lifecycle scripts and disable them when they are unnecessary.
  • Re-audit dependency updates before changing pinned versions or commit identifiers.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill tells users to execute curl -fsSL https://bun.sh/install | bash, which downloads a remote script and immediately runs it in the shell. This is a classic arbitrary code execution and supply-chain risk: if the remote server, transport, installer, or upstream distribution is compromised, the user's machine can be fully compromised.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

If exa-cli is not found, install and build it:

bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle exa
npx api2cli link exa

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | bash construct is dangerous because it executes network-fetched content without review, collapsing download and execution into a single step. In this skill's setup context, the user is encouraged to run it as a prerequisite, making exploitation straightforward if the fetched script is altered maliciously.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

If exa-cli is not found, install and build it:

bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle exa
npx api2cli link exa

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description includes broad phrases like web search, find similar pages, and ai answer, which can cause the skill to activate in many ordinary contexts beyond explicit user intent to use Exa. Over-broad invocation increases the chance that risky setup or command guidance is surfaced unnecessarily, amplifying the impact of the other installation-related issues.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx api2cli install Melvynx/exa-cli without pinning a specific version or immutable source. That creates a supply-chain risk: future or compromised package contents could be fetched and executed implicitly, which is especially dangerous in a setup section that encourages direct installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

npx api2cli bundle exa references an unpinned tool invocation, so the build step depends on whatever version npx resolves at runtime. In a skill that may be followed verbatim, this exposes users to unexpected or malicious code changes in the toolchain.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

npx api2cli link exa continues the unpinned toolchain pattern and modifies the user environment/PATH using a runtime-resolved package version. This increases supply-chain and persistence risk because an attacker controlling the package or a dependency could influence both execution and shell environment changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.