Ledgi

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:18 AM UTC
• Version: 1.0.0

Overview

The skill is for a legitimate finance-tracker workflow, but it recommends unsafe remote installation and enables persistent financial record changes without clear confirmation safeguards.

Review carefully before installing. Prefer installing the Ledgi CLI through a pinned, verifiable release rather than running the documented curl-to-bash command. Use the narrowest API scopes available, avoid putting API keys on command lines or in shared logs, and require the agent to confirm exact account, holding, snapshot, or ISA changes before it runs any write command.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:15

Finding

Unverified Remote Installer Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://raw.githubusercontent.com/LedgiApp/ledgi-cli/main/install.sh | bash

Technical Analysis

The installation instruction downloads install.sh from the mutable main branch of an external GitHub repository and immediately executes the response with Bash. It provides no commit pinning, cryptographic checksum, signature validation, package-manager provenance, or opportunity to inspect the downloaded file before execution.

Installing the Ledgi CLI is relevant to the Skill's declared financial-data functionality. However, executing mutable network content directly exceeds the minimum privileges safely necessary to perform that installation. The effective installer can change after this Skill has been reviewed, and the external installer itself is not included in the audited project. Its behavior, destination API endpoints, filesystem changes, and handling of the LEDGI_API_KEY therefore cannot be verified from the available files.

This creates a supply-chain execution channel. Control or compromise of the upstream repository, its maintainers' credentials, or the delivery trust path could turn the documented prerequisite into arbitrary code execution.

Attack Path

1. An attacker gains control of the upstream LedgiApp/ledgi-cli repository, a maintainer account, or the mutable main branch.
2. The attacker replaces or modifies install.sh with a malicious payload.
3. A user or agent follows the installation instruction in SKILL.md.
4. curl retrieves the attacker-controlled script without validating its expected content or identity.
5. The shell executes the response immediately under the invoking user's permissions.
6. The payload can access resources available to that user and may attempt further compromise, including theft of credentials or insta ...[truncated 857 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash installation pattern.
2. Prefer installation from a reputable package registry using an explicitly pinned release version.
3. If direct download is necessary:
   • Pin the download URL to an immutable release artifact or audited commit rather than main.
   • Publish an expected SHA-256 or stronger cryptographic digest through a separately protected channel.
   • Download the installer to a local file.
   • Verify its checksum or trusted digital signature before execution.
   • Allow the user to inspect the installer before running it.
4. Document the installer operations, required permissions, installed paths, network destinations, and uninstall procedure.
5. Run installation without elevated privileges unless a specific operation demonstrably requires them.
6. Request only the narrow Ledgi API scopes needed for each workflow and avoid exposing the API key through command-line arguments, logs, or installer subprocesses.
7. Consider distributing the CLI reproducibly and publishing signed release provenance so users can verify that the artifact corresponds to reviewed source.

A safer pattern would resemble:

bash

curl -fSLo ledgi-install.sh \
  "https://raw.githubusercontent.com/LedgiApp/ledgi-cli/<AUDITED_COMMIT>/install.sh"

echo "<EXPECTED_SHA256>  ledgi-install.sh" | sha256sum --check -
less ledgi-install.sh
bash ledgi-install.sh

The commit and checksum must be replaced with independently verified, immutable values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The curl ... | bash pattern is a classic high-risk command-chaining construct because it turns untrusted network content directly into shell execution with no inspection boundary. In the context of an agent skill, this is more dangerous because an automated system may execute the command without human review, enabling full compromise of the host if the fetched script is malicious or altered.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

• The ledgi CLI must be installed. If not, install with:

  bash

  curl -fsSL https://raw.githubusercontent.com/LedgiApp/ledgi-cli/main/install.sh | bash
  

• The LEDGI_API_KEY environment variable must be set, or the user must have run ledgi login --api-key ledgi_sk_...

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs use of an API key and even shows a login pattern using a raw secret on the command line, but it does not warn about secure credential handling, exposure in shell history, or privacy implications of accessing personal financial data. In a finance context, poor credential hygiene can lead to unauthorized access to sensitive account balances, holdings, and related personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill provides direct workflows to create and modify highly sensitive financial records, including accounts, holdings, snapshots, and ISA deposits, but does not require explicit user confirmation before state-changing actions. In an agent setting, this increases the risk of accidental or prompt-induced tampering with personal finance data, especially because the commands are immediately actionable and affect persistent records.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The ISA-related commands and examples are specific to the UK tax system, including references to ISA allowance usage and UK-style tax years, but the file does not state that the skill is UK-specific or otherwise limited to that locale. SQP-3 applies because this is a locale-specific policy choice presented as a default without user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill recommends installing the CLI by fetching a remote script and piping it directly to the shell. This creates a supply-chain execution risk: if the remote content, transport, repository, or dependency chain is compromised, arbitrary code will run immediately in the user's environment.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

• The ledgi CLI must be installed. If not, install with:

  bash

  curl -fsSL https://raw.githubusercontent.com/LedgiApp/ledgi-cli/main/install.sh | bash
  

• The LEDGI_API_KEY environment variable must be set, or the user must have run ledgi login --api-key ledgi_sk_...

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file documents an --api-key flag that accepts API credentials, but it does not include any warning that passing secrets on the command line may expose them through shell history or process inspection. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.