ClawHub
Back to skill

Security audit

starship-prompt

Security checks for vulnerabilities and agentic risk

Overview

This Starship prompt skill is mostly coherent reference material, but it includes copy-paste installation guidance that pipes a remote script directly into a shell without validation.

Review this skill before installing if you expect agents to execute setup commands. Prefer the Fedora package-manager or Cargo install paths, avoid running the `curl ... | sh` installer unless you inspect and trust the fetched script, and back up `~/.config/starship.toml` before applying presets that write directly to it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

External Script Fetching

High
Category
Supply Chain
Content
dnf copr enable atim/starship
dnf install starship

# Via curl install script
curl -sS https://starship.rs/install.sh | sh

# Via cargo
Confidence
98% confidence
Finding
The documentation explicitly instructs fetching and executing an external script from the network. This is dangerous because it transfers trust to a remote endpoint at execution time, enabling full arbitrary command execution if the source or transport is compromised.

Chaining Abuse

High
Category
Tool Misuse
Content
dnf install starship

# Via curl install script
curl -sS https://starship.rs/install.sh | sh

# Via cargo
cargo install starship --locked
Confidence
98% confidence
Finding
The `| sh` pipeline causes unreviewed remote content to be executed immediately, which amplifies the danger of the previous finding by eliminating any inspection step. In a shell-focused skill, users are especially likely to copy-paste such commands, making this context more dangerous rather than less.

Credential Access

High
Category
Privilege Escalation
Content
symbol = ' '
detect_extensions = ['py', 'pyw']
detect_files = ['requirements.txt', 'pyproject.toml', 'Pipfile', 'poetry.lock']
detect_folders = ['.venv', 'venv', 'env', '.env']

[bun]
format = 'via [$symbol$version]($style) '
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill includes a classic `curl ... | sh` installation path without any warning, checksum verification, or recommendation to inspect the fetched script first. Even in benign documentation, piping remote content directly into a shell creates a supply-chain risk because a compromised server, DNS, TLS interception, or malicious upstream change would result in immediate code execution on the user's system.

Session Persistence

Medium
Category
Rogue Agent
Content
starship <COMMAND>

Commands:
  bug-report    Create a pre-populated GitHub issue with config info
  completions   Generate shell completions for your shell to stdout
  config        Edit the starship configuration
  explain       Explains the currently showing modules
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| `localip` | IPv4 of primary network interface |
| `memory_usage` | RAM usage |
| `battery` | Only below 10% by default |
| `sudo` | When sudo credentials are cached |
| `cmd_duration` | Last command execution time |
| `jobs` | Background job count |
| `status` | Exit code of last command |
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The preset command writes directly to `~/.config/starship.toml` using `-o` without warning that this may overwrite an existing configuration. This is not code execution, but it can cause destructive loss of user configuration or unintended prompt behavior if followed blindly.

Static analysis

No suspicious patterns detected.