T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/devbox.sh:360- Finding
Unverified Remote Bun Installer Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Devbox
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Docker dev-environment helper, but it needs Review because it can generate Docker setups that run unverified remote installers and expose development services with weak defaults.
Review generated docker-compose.dev.yml before running it. Avoid the Bun path unless the installer is pinned or replaced, bind databases to localhost or avoid publishing their ports, change all default credentials, and do not use this on projects containing sensitive secrets without checking mounted files and env_file settings.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/devbox.sh:759- Finding
Generated Database Services Are Publicly Exposed with Fixed or Missing Authentication
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/docker-templates.md:446- Finding
Reference Templates Reproduce Insecure Database Exposure and Predictable Credentials
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/devbox.sh:389- Finding
Unvalidated User-Controlled Values Are Interpolated into Generated YAML and Shell Commands
- Content
View full analysis
" >> "$COMPOSE_FILE" echo " sh -c \"${install_cmd} && ${dev_cmd}\"" >> "$COMPOSE_FILE" ``` Representative command construction includes the unvalidated `${port}` value: ```bash pnpm) dev_cmd="PORT=${port} pnpm dev --host 0.0.0.0 --port ${port}" ;; yarn) dev_cmd="PORT=${port} yarn dev --host 0.0.0.0 --port ${port}" ;; bun) dev_cmd="PORT=${port} bun run dev --host 0.0.0.0 --port ${port}" ;; *) dev_cmd="PORT=${port} npm run dev -- --host 0.0.0.0 --port ${port}" ;; ``` Project paths, project names, ports, and environment-file values are also written directly into YAML: ```bash echo " - ${proj_path}:/app" >> "$COMPOSE_FILE" echo " - \"${port}:${port}\"" >> "$COMPOSE_FILE" ``` ```bash if [ -n "$env_file" ] && [ -f "$proj_path/$env_file" ]; then echo " env_file:" >> "$COMPOSE_FILE" echo " - ${env_file}" >> "$COMPOSE_FILE" fi ``` ### Technical Analysis The script accepts positional port and project-path values and an `--env-file` value, but does not enforce strict syntax before interpolating them into Compose YAML. The project name is derived from the basename of the supplied path and is likewise used as a YAML service and volume identifier without validation. In Node-oriented branches, the port becomes part of a command string executed by `sh -c`. A crafted value containing shell metacharacters can alter the generated command. Newline or YAML-significant characters in paths, names, or environment-file arguments can alter the structure of the generated Compose document. The Skill itself only writes the malicious text; exploitation completes when the user subsequently runs the generated Compose file. Execution normally occurs as root inside ...[truncated 1705 chars]- Remediation
View remediation
= 1 && PORT <= 65535 )) || exit 1 ``` 2. Resolve project paths to canonical absolute paths and reject newline, carriage-return, NUL, and other unsafe characters. 3. Restrict project and service identifiers to a safe character allowlist such as `[A-Za-z0-9._-]`, transforming or rejecting other values. 4. Validate `--env-file` as a normalized relative path beneath the project directory and reject traversal or control characters. 5. Generate Compose YAML with a structured YAML library instead of concatenating strings with `echo`. 6. Use Compose command arrays where possible and avoid `sh -c`. 7. If a shell is unavoidable, pass dynamic values as positional parameters rather than inserting them into shell source. 8. Validate framework and service overrides against explicit allowlists. 9. Refuse to overwrite an existing Compose file without confirmation or an explicit force flag. 10. Run generated application containers as non-root and minimize writeable mounts. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The `scripts/devbox.sh` script:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The `scripts/devbox.sh` script:
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The generated command downloads and immediately executes a remote script via curl | bash. If the remote endpoint, transport chain, or delivered script is compromised, arbitrary code will run in the container during setup, with access to the mounted application source and any injected environment values.
- Content
sh case "$pkg_mgr" in pnpm) install_cmd="npm install -g pnpm && pnpm install --no-frozen-lockfile" ;; yarn) install_cmd="npm install -g yarn && yarn install" ;; bun) install_cmd="curl -fsSL https://bun.sh/install | bash && export BUN_INSTALL=/root/.bun && export PATH=\$BUN_INSTALL/bin:\$PATH && bun install" ;; *) install_cmd="npm install" ;; esac
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
This repeats the same unsafe remote-script execution pattern in the Node backend path. Because the container bind-mounts the project directory, malicious code run by the installer can tamper with source code, build artifacts, or developer secrets available inside the container.
- Content
sh case "$pkg_mgr" in pnpm) install_cmd="npm install -g pnpm && pnpm install --no-frozen-lockfile" ;; yarn) install_cmd="npm install -g yarn && yarn install" ;; bun) install_cmd="curl -fsSL https://bun.sh/install | bash && export BUN_INSTALL=/root/.bun && export PATH=\$BUN_INSTALL/bin:\$PATH && bun install" ;; *) install_cmd="npm install" ;; esac echo " command: >" >> "$COMPOSE_FILE"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh generate_compose "$DETECTED_FW" "$PORT" "$PROJECT_PATH" "$PROJECT_NAME" "$PKG_MANAGER" "$PNPM_STORE" "$ENV_FILE" # 更新 .gitignore IGNORE_ENTRIES=("docker-compose.dev.yml" ".env.local" ".env.development" ".env") case "$DETECTED_FW" in nuxt|next|vue|react|vitepress|svelte|node) IGNORE_ENTRIES+=("node_modules/" ".pnpm-store/")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh generate_compose "$DETECTED_FW" "$PORT" "$PROJECT_PATH" "$PROJECT_NAME" "$PKG_MANAGER" "$PNPM_STORE" "$ENV_FILE" # 更新 .gitignore IGNORE_ENTRIES=("docker-compose.dev.yml" ".env.local" ".env.development" ".env") case "$DETECTED_FW" in nuxt|next|vue|react|vitepress|svelte|node) IGNORE_ENTRIES+=("node_modules/" ".pnpm-store/")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh generate_compose "$DETECTED_FW" "$PORT" "$PROJECT_PATH" "$PROJECT_NAME" "$PKG_MANAGER" "$PNPM_STORE" "$ENV_FILE" # 更新 .gitignore IGNORE_ENTRIES=("docker-compose.dev.yml" ".env.local" ".env.development" ".env") case "$DETECTED_FW" in nuxt|next|vue|react|vitepress|svelte|node) IGNORE_ENTRIES+=("node_modules/" ".pnpm-store/")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README encourages users to generate and run a Docker Compose configuration but does not warn that doing so may expose application and database ports, start network-reachable services, and create or modify project-side files such as compose manifests and env-related configuration. In a dev-environment skill, users are likely to execute these steps directly, so the omission increases the chance of unintended service exposure or trust in generated infrastructure without review.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes shell scripts and instructs users to copy and execute them, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This weakens security transparency and policy enforcement because consumers cannot easily tell that shell execution and file-writing behavior are required before use.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
md pnpm install --no-frozen-lockfile && PORT=3000 pnpm dev --host 0.0.0.0 --port 3000" environment: - NODE_ENV=development - NITRO_PORT=3000 - NITRO_HOST=0.0.0.0 - CHOKIDAR_USEPOLLING=true
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
md pnpm install --no-frozen-lockfile && PORT=3000 pnpm dev --host 0.0.0.0 --port 3000" environment: - NODE_ENV=development - NITRO_PORT=3000 - NITRO_HOST=0.0.0.0 - CHOKIDAR_USEPOLLING=true
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
md pnpm install --no-frozen-lockfile && PORT=3000 pnpm dev --host 0.0.0.0 --port 3000" environment: - NODE_ENV=development - NITRO_PORT=3000 - NITRO_HOST=0.0.0.0 - CHOKIDAR_USEPOLLING=true
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script's user-facing comments, descriptions, and many runtime messages are written in Chinese, while some help text is in English, with no explicit language selection or opt-in. This creates a locale/language constraint in natural-language interaction that is not documented as optional or region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a tool that creates a Docker-based dev environment and generated files such as compose/config artifacts, but this function also edits the target project's .gitignore in place. That is a broader write operation to user source metadata, not just generating container-environment files, and it is not disclosed in the manifest description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The ensure_gitignore function appends entries to the project's .gitignore, creating or changing repository files as a side effect. While it logs each change as it happens, the skill description and invocation flow do not clearly warn users in advance that their existing .gitignore will be edited.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This shell script generates and writes a docker-compose.dev.yml file directly into the user-supplied project path, which is a file-modifying operation. Although later output reports that the file was created, there is no prior warning, confirmation prompt, or explicit disclosure near invocation that the script will modify files in the target project.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
sh echo " ports:" >> "$COMPOSE_FILE" echo " - \"${port}:${port}\"" >> "$COMPOSE_FILE" echo " environment:" >> "$COMPOSE_FILE" echo " - NODE_ENV=development" >> "$COMPOSE_FILE" # Nuxt 专用环境变量 if [ "$fw" = "nuxt" ]; then
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
sh echo " ports:" >> "$COMPOSE_FILE" echo " - \"${port}:${port}\"" >> "$COMPOSE_FILE" echo " environment:" >> "$COMPOSE_FILE" echo " - NODE_ENV=development" >> "$COMPOSE_FILE" # Nuxt 专用环境变量 if [ "$fw" = "nuxt" ]; then
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated Compose file installs tooling and dependencies at container runtime by pulling code from public package registries and, for Bun, executing a remote install script. This expands the supply-chain attack surface and means every environment startup may execute unpinned third-party code inside a container with access to the mounted project source.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
sh echo " - \"${port}:5000\"" >> "$COMPOSE_FILE" echo " environment:" >> "$COMPOSE_FILE" echo " - FLASK_APP=app.py" >> "$COMPOSE_FILE" echo " - FLASK_ENV=development" >> "$COMPOSE_FILE" echo " command: >" >> "$COMPOSE_FILE" echo " sh -c \"pip install -r requirements.txt && flask run --host 0.0.0.0 --port 5000 --reload\"" >> "$COMPOSE_FILE" ;;
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file explains that the script generates a compose file, but it does not explicitly warn users that invoking the skill modifies the target project by creating a new file. Because markdown files should disclose behaviors that affect user data or system state, this file-write side effect should be called out more clearly in the usage or quick-start sections.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file is primarily written in English, but some headings and table labels switch to Chinese (
隔离策略,隔离速查表,项目类型,命名卷) without indicating that the skill is multilingual or giving the user a language option. This can violate language/locale policy because it imposes a locale choice without opt-in or justification.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing instructional text in Chinese alongside English headings and technology names, but it does not state that the skill is intended specifically for Chinese-speaking users or offer an alternative language. Under the natural-language policy rules, forcing a specific language or locale without opt-in can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script includes comments and user-facing warning/usage text only in Chinese, which imposes a specific language/locale without offering the user a choice. The policy explicitly flags language-forcing behavior unless the locale constraint is documented and justified or the user can opt in.
- Content
Static analysis
No suspicious patterns detected.