onescience-installer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.0

Overview

The installer is coherent, but it needs review because it reads the full SSH config and runs unpinned external installation scripts on a remote cluster account.

Before installing, be comfortable with the agent seeing SSH host metadata and running the current upstream OneScience installer on a remote account. Prefer providing the intended host yourself, using a least-privileged cluster account, reviewing the remote commands, and pinning or verifying the uv version and OneScience commit before execution.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: docs/install-sequence.md:16

Finding

Mutable External Dependencies Are Retrieved and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: docs/install-sequence.md:16-26, 36-42
Vulnerability Type: Remote payload retrieval and insecure dependency management
Risk Level: High

Vulnerable Code:

bash

conda create -n uv311 python=3.11 -y
conda activate uv311
python -m pip install uv

bash

git clone https://gitee.com/onescience-ai/onescience.git
cd onescience

bash

bash install.sh earth
bash install.sh cfd
bash install.sh bio
bash install.sh matchem
bash install.sh

Technical Analysis

The installation workflow downloads uv without a pinned version or package hash. It also clones the mutable default branch of an external repository and executes its install.sh script. No commit pin, release signature, checksum, package hash, or manual verification step is required before execution.

Consequently, the code ultimately executed on the remote DCU host can change after this Skill has been reviewed. Compromise of the package registry, package publisher, source repository, maintainer account, or upstream default branch could turn the documented installation process into an arbitrary-code execution channel.

This finding is primarily remote payload retrieval and execution because externally controlled shell code is fetched and run. The unpinned installation of uv also creates an insecure dependency risk.

Attack Path

1. An attacker compromises the upstream OneScience repository, a maintainer account, or the package-distribution channel used for uv.
2. The attacker modifies the default repository branch, install.sh, or a distributed dependency to include malicious commands.
3. The Agent follows the Skill and installs the current unpinned uv package.
4. The Agent clones the current mutable default branch from Gitee without verifying a commit, signature, or checksum.
5. The Agent executes the attacker-controlled install.sh on the remote DCU host.
6. The ...[truncated 806 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin uv to a specifically reviewed version and require package hashes, for example through a hash-locked requirements file.
2. Clone an immutable, reviewed commit rather than the repository's mutable default branch.
3. Prefer signed releases and verify the release signature against a trusted, documented maintainer key.
4. Verify a published SHA-256 checksum before running any downloaded script or artifact.
5. Add a mandatory review step that displays or inspects the resolved install.sh before execution.
6. Ensure all transitive dependencies are locked and obtained only from explicitly approved registries.
7. Run installation with a minimally privileged cluster account and restrict access to unrelated credentials and sensitive datasets.
8. Record the exact package versions, repository commit, hashes, and verification results in the installation output.

other

Note

• Location: SKILL.md:24

Finding

Unconditional Reading of the Full SSH Configuration Exposes Unnecessary Infrastructure Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-25, 39-44
Vulnerability Type: Excessive access to sensitive SSH configuration metadata
Risk Level: Low

Vulnerable Code:

text

- Always read the user's local `~/.ssh/config` first.
- Identify available remote hosts before doing anything else.

text

### Step 1: Read SSH Configuration

Use a shell command to read:

- `~/.ssh/config`

Technical Analysis

The Skill unconditionally instructs the Agent to read the user's complete SSH configuration before performing any other action. Selecting a remote host is consistent with the declared installation purpose, but reading the entire file is broader than necessary when the user could supply a host alias or when only a filtered list of aliases is required.

SSH configuration files can reveal sensitive infrastructure metadata, including internal hostnames, usernames, ports, bastion routes, proxy commands, network topology, and paths to identity files. The audited files do not instruct the Agent to read private-key contents or exfiltrate the configuration. Nevertheless, placing the complete configuration into Agent context increases the possibility of accidental disclosure through generated output, logs, telemetry, or subsequent tool use.

Attack Path

1. A user invokes the installation Skill.
2. The Agent follows the mandatory first step and reads the complete ~/.ssh/config.
3. Configuration entries for unrelated systems enter the Agent's working context.
4. Internal hostnames, usernames, proxy routes, or identity-file paths may subsequently be reproduced in output or retained in execution logs.
5. A party with access to those outputs or logs gains infrastructure reconnaissance information that was not required for the selected installation target.

Impact Assessment

The direct impact is disclosure of SSH and network metadata rather than disclosure of private-key material. Exp ...[truncated 416 chars]

Remediation

View remediation

Remediation Suggestions

1. Ask the user to provide the intended SSH host alias before reading any local configuration.
2. If discovery is necessary, parse only Host aliases and avoid loading the raw configuration into Agent context.
3. Resolve only the configuration fields required for the user-selected host.
4. Explicitly prohibit reading SSH private keys, public-key files, known-host databases, or unrelated credential material.
5. Never print the raw SSH configuration in responses or installation logs.
6. Redact usernames, internal addresses, proxy routes, and identity-file paths from diagnostics unless the user explicitly requests them.
7. Require confirmation before connecting to a selected host, especially when multiple aliases are available.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md

# Install Sequence

Reference sequence for remote DCU installation.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

# Install Sequence

Reference sequence for remote DCU installation.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/domain-map.md (reported line 1)May include surrounding context.

md

# Install Sequence

Reference sequence for remote DCU installation.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/install-sequence.md (reported line 1)May include surrounding context.

md

# Install Sequence

Reference sequence for remote DCU installation.

Static analysis

No suspicious patterns detected.