T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:29- Finding
Unverified Remote Installer Executed Through Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Dataecho
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent deployment purpose, but it tells users or agents to execute mutable remote installers and handle a permanent API key in ways that need review before installation.
Install only after reviewing or replacing the remote installer flow with a pinned, verified download or bundled scripts. Use this skill only when you explicitly want content sent to DataEcho, avoid uploading secrets or private source by accident, and store or rotate the DataEcho API key carefully.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:33- Finding
Unverified Remote PowerShell Installer Executed with Invoke-Expression
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:104- Finding
Unsafe API-Key Capture and Local Credential-File Creation
- Content
View full analysis
"}' echo '' > ~/.artifact/credentials && chmod 600 ~/.artifact/credentials ``` ### Technical Analysis The verification request emits its response to standard output. According to the surrounding documentation, that response contains the API key and returns it only once. Standard output may be captured in terminal scrollback, agent transcripts, CI logs, command wrappers, or other session records. The subsequent manual `echo` command encourages users to place the secret directly in a command line, which can expose it through shell history, process instrumentation, copied transcripts, or command logging. Although the file is eventually changed to mode `0600`, redirection creates or truncates it before `chmod` runs. Its initial permissions therefore depend on the active `umask`, creating a possible interval in which the file is more broadly readable than intended. The command also does not create or permission-harden `~/.artifact`. If the directory is absent, storage fails after the one-time key has already been displayed. If it exists with weak permissions, metadata and other contents may be unnecessarily exposed. The instructions correctly use HTTPS and recommend mode `0600`, but the overall workflow does not safely capture and persist the one-time secret. ### Attack Path 1. The user submits a valid email and one-time verification code. 2. The service returns an API key in the response to the second `curl` command. 3. `curl` writes the response, including the ...[truncated 1314 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs users to install helper scripts by downloading and executing remote code directly from the service domain, without any warning, pinning, checksum verification, or review step. In an agent context, this is especially dangerous because it normalizes arbitrary code execution from the network and could lead to compromise if the endpoint, CDN, or DNS is tampered with.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The skill fetches a shell installer from a remote host and immediately executes it. This is a classic supply-chain risk: compromise of the hosting domain, TLS termination, installer path, or upstream content would give an attacker code execution on the agent's environment.
- Content
bash # macOS / Linux (bash + python3) curl -fsSL https://dataecho.ai/install.sh | bashpowershell # Windows (PowerShell — no bash/python needed) → scripts\publish.ps1
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The explicit use of a pipe into bash removes any opportunity for inspection and chains network retrieval directly into command execution. In a skill that may be followed by autonomous agents, this materially increases the chance of silent compromise and abuse through chained command execution.
- Content
bash # macOS / Linux (bash + python3) curl -fsSL https://dataecho.ai/install.sh | bashpowershell # Windows (PowerShell — no bash/python needed) → scripts\publish.ps1
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description is extremely broad, covering publishing, hosting, sharing, deployment, and cross-session storage. That increases the chance an agent invokes this skill in situations where data should not be sent to a third-party hosting platform, leading to unnecessary exposure of user files, code, or artifacts.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
The skill explicitly encourages deploying persistent server-side apps and storing application data under /data so it survives redeploys. In context, this creates durable session and data persistence on a third-party platform, which becomes risky if agents publish apps containing sensitive user data, tokens, or state without clear retention and consent controls.
- Content
Server-side apps (Dockerfile)
For anything that needs a backend, write a
Dockerfileand publish the folder:bash scripts/publish.sh ./my-app # builds the image, runs the container, waits until live
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
API key (permanent sites, Drives)
bash curl -sS -X POST https://dataecho.ai/api/auth/agent/request-code -H 'content-type: application/json' -d '{"email":"user@example.com"}' # user reads the emailed code, then: curl -sS -X POST https://dataecho.ai/api/auth/agent/verify-code -H 'content-type: application/json' -d '{"email":"user@example.com","code":"<CODE>"}' echo '<API_KEY>' > ~/.artifact/credentials && chmod 600 ~/.artifact/credentials
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
curl -sS -X POST https://dataecho.ai/api/auth/agent/request-code -H 'content-type: application/json' -d '{"email":"user@example.com"}'
user reads the emailed code, then:
curl -sS -X POST https://dataecho.ai/api/auth/agent/verify-code -H 'content-type: application/json' -d '{"email":"user@example.com","code":"
"}' echo '<API_KEY>' > ~/.artifact/credentials && chmod 600 ~/.artifact/credentialstext The verify-code response returns `apiKey` **once** — capture it and write it to the credentials
Static analysis
No suspicious patterns detected.