ClawHub
Back to skill

Security audit

Matter CLI

Security checks for vulnerabilities and agentic risk

Overview

This Matter skill is coherent, but it asks users to install an unverified mutable CLI binary and gives the agent broad library-changing authority.

Review the install command before use. Prefer a pinned Matter CLI release with a verified checksum or signature, and only let the agent use this skill when you explicitly mean your Matter account. Confirm destructive actions such as deleting items, annotations, or tags before allowing them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:10
Finding

Unverified Mutable Binary Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:10-21
Vulnerability Type: Remote payload retrieval without version pinning or integrity verification
Risk Level: High

bash
# Install (downloads binary directly from official GitHub releases)
# macOS arm64:
curl -fsSL https://github.com/getmatterapp/matter-cli/releases/latest/download/matter-darwin-arm64 -o ~/.matter/bin/matter && chmod +x ~/.matter/bin/matter

# macOS x86:
curl -fsSL https://github.com/getmatterapp/matter-cli/releases/latest/download/matter-darwin-x64 -o ~/.matter/bin/matter && chmod +x ~/.matter/bin/matter

# Linux arm64:
curl -fsSL https://github.com/getmatterapp/matter-cli/releases/latest/download/matter-linux-arm64 -o ~/.matter/bin/matter && chmod +x ~/.matter/bin/matter

# Linux x86:
curl -fsSL https://github.com/getmatterapp/matter-cli/releases/latest/download/matter-linux-x64 -o ~/.matter/bin/matter && chmod +x ~/.matter/bin/matter

Technical Analysis

The setup instructions download a precompiled executable from mutable GitHub latest release URLs and immediately grant it executable permissions. No fixed release version, cryptographic checksum, or signature verification is specified.

Consequently, the payload executed by a user can differ from the artifact that was available when the Skill was audited. HTTPS protects transport in ordinary circumstances but does not protect against compromise of the upstream repository, release account, build pipeline, or release assets. A replaced binary would execute as the local user and would be invoked during authentication and subsequent Matter operations.

Attack Path

  1. An attacker compromises the upstream release account, release workflow, or another component capable of modifying GitHub release assets.
  2. The attacker replaces one or more binaries referenced by the mutable releases/latest/download/ URLs.
  3. A user follows the documented setup command, downloading the subs ...[truncated 1034 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin downloads to a specific, reviewed release version rather than using releases/latest.
  2. Publish trusted SHA-256 checksums in the Skill or retrieve them through a separately authenticated, immutable channel.
  3. Verify the downloaded file before granting executable permissions or invoking it, and terminate installation if verification fails.
  4. Prefer vendor-provided cryptographic signatures and validate them against a pinned, independently distributed public key.
  5. Download to a temporary file, validate it, and only then atomically move it to ~/.matter/bin/matter.
  6. Where available, use a trusted package manager that provides version pinning, artifact integrity checks, and provenance verification.
  7. Document the expected version and checksum so users can independently confirm the installed binary.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is broad enough to match common user phrases like "reading list," "inbox," or "highlights," which may cause this skill to activate outside clearly intended Matter-specific contexts. That can lead to unintended access or modification attempts against a user's Matter library, especially because the skill supports write actions such as tagging, archiving, and saving URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown reference lists matter items delete <id> as a valid command but provides no warning that the action is destructive or potentially irreversible. Under the markdown-file criteria, user-facing documentation should warn about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The reference includes matter annotations delete <id> with no disclosure that it deletes user-created highlights or notes. For markdown skill documentation, omission of warnings around data-affecting operations is a quality and safety issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file documents matter tags delete <id> without warning that it removes a tag, which may affect organization of user content. Markdown documentation should disclose potentially destructive operations that impact user data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.