T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:27- Finding
Mutable Remote Installation Script Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Nudge CLI
Security checks for vulnerabilities and agentic risk
Overview
This skill is a documented accountability CLI guide, but it encourages storing embarrassing secrets and automatically sending them to contacts with insufficient safety controls.
Review carefully before installing. Prefer the Homebrew or Go path over the shell-script installer, avoid entering real tokens or sensitive secrets directly in command lines, and do not use secrets you would not be comfortable disclosing. Prefer non-sensitive punishment messages or local notifications unless the CLI provides explicit recipient confirmation, secure secret entry, deletion controls, and clear storage protections.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:62- Finding
Authentication Token Is Supplied Through a Command-Line Argument
- Content
View full analysis
``` From `references/cli-reference.md`: ```bash nudge punishment setup post_to_beeper_whatsapp --token abc123 --default-group "!room:..." ``` ### Technical Analysis The documentation instructs users to supply a Beeper authentication token directly as a command-line argument. Depending on the operating system, shell, terminal environment, and automation platform, command-line arguments may be exposed through: - Shell history files - Process inspection utilities - Process auditing and telemetry - Terminal session recordings - Debug logs - AI-agent transcripts and tool-call logs Although the token may only remain in the process table briefly, shell histories and execution logs can persist across sessions. The audited project does not include the CLI implementation, so it is also not possible to verify whether the token is subsequently encrypted, permission-restricted, or redacted. ### Attack Path 1. A user follows the documented setup command and replaces the placeholder with a real Beeper token. 2. The complete command is stored in shell history, an agent transcript, telemetry, or another execution log, or is temporarily exposed through process inspection. 3. Another local user, process, administrator, support operator, or log reader obtains the token. 4. The attacker uses the token against the associated service. 5. The attacker performs whatever messaging or account operations the token's granted scope permits. ### Impact Assessment The exact privileges depend on the externally issued token and cannot be determined from the audited files. At minimum, disclosure could allow unauthorized interaction with the configured Be ...[truncated 357 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:79- Finding
Embarrassing Personal Secrets Are Passed as Plaintext Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping curl output directly into sh removes the opportunity for inspection and executes untrusted remote content immediately. This is a well-known dangerous pattern that can lead to arbitrary code execution if the remote content, transport, hosting account, or dependency chain is compromised.
- Content
Shell script (macOS and Linux)
bash curl -sSL https://raw.githubusercontent.com/neilsanghrajka/nudge/main/scripts/install.sh | shGo install (requires Go toolchain)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The onboarding flow encourages collection of '3-5 embarrassing secrets' and discusses revealing them to contacts, but does not warn users about the sensitivity of that data, retention risks, downstream disclosure, or the consequences of sending it to third parties. In this context, omission of a warning materially increases the risk of privacy harm, coercion, blackmail-like dynamics, and accidental exposure of extremely sensitive information.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The overall onboarding script builds rapport ('I'm your accountability coach'), gathers sensitive material, links it to named contacts and messaging channels, and frames automatic disclosure as punishment. This combination increases danger beyond ordinary privacy issues because it operationalizes coercion and automated release of sensitive information to third parties, which can cause severe reputational, social, and psychological harm.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs the agent to solicit embarrassing secrets and store them for later punitive disclosure. That creates a direct pipeline for collecting sensitive personal information under trust and then weaponizing it, which is inherently dangerous and can facilitate extortionary or abusive outcomes even if framed as motivation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill metadata says to trigger whenever the user wants to create a task, add a secret, check status, configure punishment, run any nudge command, or when setup is needed. That broad routing can cause the agent to invoke this skill in many contexts, including ones involving sensitive data collection and coercive workflows, increasing the chance users are steered into unsafe behaviors without clear consent boundaries.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Task Commands
Create a task
bash nudge task add --desc "Finish the PR review" --duration 30 --why "Team is blocked" --secret-id s-1 nudge task add --desc "Ship feature" --duration 60 --punishment post_to_beeper_whatsapp --targets "!roomid:..."
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI reference explicitly documents a workflow where a failed task can send a stored secret to external targets, but it does not clearly warn users about the privacy and irreversibility implications of disclosing sensitive personal information. In this skill context, that omission is more dangerous because the documentation directly encourages onboarding and operational use of punishment actions, increasing the chance users configure and trigger real secret exfiltration without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The setup example shows a live token being passed directly on the command line without warning that CLI arguments may be exposed through shell history, process listings, logs, or screenshots. In a setup/onboarding skill, this is especially risky because users often copy-paste examples verbatim, potentially leaking credentials for messaging integrations used by the punishment action.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The skill recommends installing via a remote shell script fetched from the internet at runtime. Even over HTTPS, this pattern exposes users to supply-chain compromise, repository/account takeover, or silent script changes, and the risk is amplified because users are told to execute it directly without inspection.
- Content
Shell script (macOS and Linux)
bash curl -sSL https://raw.githubusercontent.com/neilsanghrajka/nudge/main/scripts/install.sh | shGo install (requires Go toolchain)