ClawHub
Back to skill

Security audit

Semanticfs

Security checks for vulnerabilities and agentic risk

Overview

The skill’s local code-search purpose is coherent, but its install instructions pipe a mutable GitHub script directly into Bash and it runs a local indexing server, so users should review it before installing.

Install only if you trust the SemanticFS repository and are comfortable reviewing the installer first. Prefer a pinned release or checksum-verified installer, index only workspaces you intend to make searchable, and start the local server only when needed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:40
Finding

Unverified Remote Installer Is Piped Directly into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:40
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

bash
curl -sSfL https://raw.githubusercontent.com/Navneeth08k/semanticFS/main/scripts/install.sh | bash

Technical Analysis

The documented installation command retrieves a shell script from the mutable main branch of a personal GitHub repository and immediately executes it with Bash. The artifact does not include the installer, so its behavior could not be audited as part of this review.

No immutable commit or release version is selected, and the command performs no cryptographic hash or signature verification. Piping the response directly into Bash also prevents meaningful inspection before execution. Consequently, the effective installation payload can change after the Skill has been reviewed.

Although installing the semanticfs executable supports the Skill's stated functionality, remote, unverified shell execution exceeds the minimum-risk method necessary to perform that installation. The installer receives all permissions held by the invoking user.

Attack Path

  1. An attacker compromises the referenced repository, its maintainer account, or another component of the content-delivery trust chain.
  2. The attacker modifies scripts/install.sh on the mutable main branch.
  3. A user or agent follows the prerequisite instructions in SKILL.md.
  4. curl downloads the modified response from the external URL.
  5. The shell pipeline passes the response directly to Bash without integrity verification or review.
  6. The attacker's commands execute with the permissions of the invoking user and can retrieve additional payloads or interact with user-accessible system resources.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's privileges. The payload could read or modify accessible ...[truncated 570 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not pipe network responses directly into a shell. Download the installer to a local file and require inspection before explicit execution.

  2. Prefer distributing the executable through a trusted package manager or signed release mechanism.

  3. Pin downloads to an immutable release artifact or commit rather than the mutable main branch.

  4. Publish and verify a cryptographic digest or signature before running the installer. Store the expected digest in a separately authenticated, versioned location.

  5. Include the installer in the audited Skill package when practical so its complete behavior can be reviewed.

  6. Run installation with an unprivileged account and request elevated privileges only for narrowly defined operations that genuinely require them.

  7. Use a hardened installation pattern such as:

    bash
    curl -fL -o install.sh "https://example.invalid/immutable-release/install.sh"
echo "EXPECTED_SHA256  install.sh" | sha256sum -c -
less install.sh
bash install.sh

    The placeholder URL and digest must be replaced with an immutable, authenticated release URL and its verified checksum.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Piping a remotely fetched script directly into bash is a high-risk command chaining pattern. It prevents meaningful review of the fetched content before execution and amplifies the impact of any compromise of the remote source into immediate code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash
# Install (Linux/macOS)
curl -sSfL https://raw.githubusercontent.com/Navneeth08k/semanticFS/main/scripts/install.sh | bash

# Index your workspace
semanticfs --config ~/semanticfs.toml index build

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

semanticfs --config ~/semanticfs.toml serve mcp &

Check it's up

curl -s http://localhost:9464/health/live && echo "SemanticFS is running"

text

If you get a connection refused error, the server is not running. Start it with the command above.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Replace ls -la src/ or tree src/ with:

bash
curl -s "http://localhost:9464/map?path=src" \
  | python3 -c "import sys, json; print(json.dumps(json.load(sys.stdin), indent=2))"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

semanticfs --config ~/semanticfs.toml serve mcp &

Check it's up

curl -s http://localhost:9464/health/live && echo "SemanticFS is running"

text

If you get a connection refused error, the server is not running. Start it with the command above.

External Script Fetching

Low
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs users to fetch and immediately execute a remote script from GitHub via curl ... | bash. This is dangerous because it gives arbitrary code from a mutable remote source direct shell execution, enabling supply-chain compromise if the repository, branch, or network path is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash
# Install (Linux/macOS)
curl -sSfL https://raw.githubusercontent.com/Navneeth08k/semanticFS/main/scripts/install.sh | bash

# Index your workspace
semanticfs --config ~/semanticfs.toml index build