Turso

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:21 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent Turso CLI helper, but its Linux install path runs a mutable remote shell script and its examples include destructive database and credential/token commands without safety guidance.

Install only if you are comfortable reviewing or replacing the Linux installer with a safer official package or verified download, and require explicit user confirmation before any destroy, plan upgrade, organization switch, token display, or non-expiring token creation command. Treat tokens as secrets and prefer short-lived, least-privilege credentials.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:19

Finding

Unverified Remote Installer Executed Directly Through Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -sSfL https://get.tur.so/install.sh | bash

Technical Analysis

The Linux/WSL installation instructions retrieve a mutable script from an external URL and pass it directly to Bash. The command does not pin a release, verify a cryptographic signature or checksum, save the script for inspection, or otherwise establish that the downloaded content matches a reviewed payload.

Although HTTPS provides transport protection, it does not protect against compromise of the distribution server, domain, redirect destination, or trusted certificate infrastructure. The -L option also follows redirects, allowing the final payload to be obtained from a different endpoint. Because the script is executed immediately, any attacker-controlled response can run arbitrary shell commands with the privileges of the user following the instructions.

Installing the Turso CLI is consistent with the Skill's declared functionality, but direct execution of mutable network content exceeds the minimum mechanism necessary. A version-pinned and integrity-verified package or release artifact can provide the required CLI without this execution pattern.

Attack Path

1. An attacker compromises or gains control over the installer endpoint, its hosting infrastructure, a redirect destination, or another relevant component of the delivery chain.
2. The attacker modifies the HTTP response so that it contains malicious shell commands.
3. A user or Agent follows the Linux/WSL setup instructions in SKILL.md.
4. curl downloads the current response and follows any redirects.
5. The pipeline sends the response directly to Bash without integrity validation or prior inspection.
6. The attacker's commands execute with the invoking user's privileges.

Impact Assessment

...[truncated 764 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the curl | bash pipeline with an official, version-pinned package or release artifact.
2. Publish and verify a cryptographic signature from a trusted maintainer key. If signatures are unavailable, verify a SHA-256 checksum obtained through an independently trusted channel.
3. Do not silently follow redirects during security-sensitive installation unless every allowed destination is explicitly documented and trusted.
4. Download the artifact to a local file first, validate its expected type and integrity, and only then install it.
5. If a shell script is unavoidable, require users to download and inspect it separately before execution rather than piping it directly into a shell.
6. Run installation with ordinary user privileges and avoid sudo unless a specific installation step demonstrably requires it.
7. Document the exact release version, expected checksum or signing identity, download host, files created, and permissions required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to download and immediately execute a remote shell script via curl ... | bash, which bypasses inspection, integrity verification, and normal package trust controls. If the remote endpoint, network path, or distribution infrastructure is compromised, this can result in arbitrary code execution on the host running the install command.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Linux/WSL:

bash

curl -sSfL https://get.tur.so/install.sh | bash

Verify installation:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | bash construct is a direct command-chaining pattern that executes untrusted remote content immediately, creating a classic arbitrary code execution risk. In a skill meant to guide agent-assisted CLI usage, this is especially dangerous because it may be reproduced automatically without human review.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Linux/WSL:

bash

curl -sSfL https://get.tur.so/install.sh | bash

Verify installation:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents destructive operations such as database and group deletion, as well as credential-sensitive operations like token retrieval and creation, without any warning, confirmation guidance, or handling precautions. In an agent context, this increases the chance of accidental destructive actions or unsafe token exposure because the documentation normalizes high-risk commands as routine usage.

Content

No source excerpt is available for this finding.