Agentar

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.5

Overview

The skill is coherent for using Agentar, but its install instructions tell users to execute an unverified remote shell script and unpinned package commands.

Review before installing. The Agentar use case is disclosed, but do not run the documented curl | bash command unless you trust the publisher and endpoint; prefer a pinned release with checksum or signature verification, and keep API keys and token files isolated from shared shells, logs, and transcripts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58

Finding

Unverified Remote Installer Is Streamed Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL 'https://dtaiagtavtr.antdigital.com/agentar-cli/install.sh' | bash

Technical Analysis

The installation workflow downloads a mutable shell script from an external server and passes its contents directly to bash. The payload therefore executes without prior inspection, version pinning, checksum validation, or cryptographic signature verification.

HTTPS protects the connection in transit, but it does not establish that the current remote payload is the same payload that was reviewed when this Skill was published. Compromise of the hosting service, its deployment pipeline, domain or account, or another component controlling the endpoint could allow the response to be replaced with arbitrary shell commands.

The preceding reachability check using curl -I does not validate the contents or integrity of the installer. Installation is relevant to the Skill's declared functionality, but immediate execution of an unverified remote script is not required. A versioned and integrity-verified artifact would accomplish the same task with less privilege and supply-chain exposure.

Attack Path

1. An attacker gains control over, or the ability to modify responses from, the documented installer endpoint.
2. The endpoint returns a malicious shell script instead of the expected Agentar installer.
3. A user or agent follows the Skill's recommended installation workflow.
4. curl retrieves the attacker-controlled response and streams it directly to bash.
5. The script executes arbitrary commands with the permissions and environment of the invoking user.
6. The payload can access user-readable data, modify user-writable files, steal credentials available to the process, install additional components, or retrieve further payloads.

I

...[truncated 478 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash installation instruction.
2. Publish immutable, versioned release artifacts through a verified package registry or release channel.
3. Pin the expected CLI version rather than implicitly installing the latest remotely served payload.
4. Download the installer or package to a local file before execution.
5. Publish a SHA-256 checksum through a separately protected channel and require users to verify it before installation.
6. Prefer cryptographic release signatures with documented key verification and rotation procedures.
7. Allow users to inspect the downloaded script before running it.
8. Document the installer's expected files, network requests, subprocesses, and permissions.
9. Execute installation with an unprivileged account and avoid recommending sudo unless a specific, justified operation requires it.

A safer workflow should follow this general pattern:

bash

curl -fL 'https://trusted.example/releases/agentar-cli-VERSION/install.sh' \
  -o install-agentar-cli.sh
printf '%s  %s\n' '<PINNED_SHA256>' 'install-agentar-cli.sh' | sha256sum -c -
less install-agentar-cli.sh
bash install-agentar-cli.sh

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/agentar-cli-quick-reference.md:31

Finding

Quick Reference Repeats Direct Execution of an Unverified Remote Installer

Content

View full analysis

Vulnerability Details

File Location: references/agentar-cli-quick-reference.md, line 31
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL 'https://dtaiagtavtr.antdigital.com/agentar-cli/install.sh' | bash

Technical Analysis

The quick-reference document independently instructs users and agents to execute network-supplied shell code without validating its version, checksum, signature, or contents. Because the URL can return different code after the Skill has been audited, the effective executable payload is not contained in or fixed by this project.

The use of HTTPS does not eliminate the risk of a compromised or malicious release endpoint. Likewise, the documented curl -I reachability check only confirms that the endpoint responds; it does not authenticate the installer contents.

This duplicated instruction increases exposure because users may follow the quick reference without consulting safer guidance elsewhere. Although installing the Agentar CLI supports the declared functionality, piping an unverified installer directly into a shell exceeds the minimum-risk mechanism necessary for installation.

Attack Path

1. The external installer endpoint or its publishing infrastructure is compromised.
2. An attacker replaces the expected installer response with arbitrary shell commands.
3. A user follows the quick-reference installation command.
4. The downloaded response is executed immediately by bash, without any opportunity for integrity verification or review.
5. The malicious installer acts with the invoking user's permissions and can modify files, collect accessible secrets, contact external services, or install secondary payloads.

Impact Assessment

Exploitation results in arbitrary command execution in the invoking user's security context. An attacker could access user-readable project and configuration data, a ...[truncated 328 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the quick-reference curl | bash command with the same verified installation procedure used in the primary documentation.
2. Require a pinned release version and an immutable artifact URL.
3. Download the artifact separately and verify a published checksum or cryptographic signature before execution.
4. Treat checksum or signature failure as a fatal installation error.
5. Keep integrity metadata under release controls separate from the artifact hosting path where practical.
6. Explain what the installer changes and confirm that it does not require administrative privileges.
7. Ensure all installation examples across the project use one consistent, secure workflow so the unsafe command is not reintroduced through copied documentation.

Example hardened pattern:

bash

curl -fL 'https://trusted.example/releases/agentar-cli-VERSION/install.sh' \
  -o install-agentar-cli.sh
printf '%s  %s\n' '<PINNED_SHA256>' 'install-agentar-cli.sh' | sha256sum -c -
bash install-agentar-cli.sh

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill directs users to fetch an installation script from a remote domain and treat it as authoritative. Even before the explicit pipe-to-shell step, normalizing trust in a remote script URL increases exposure to server compromise, DNS/TLS interception failures, or content replacement, especially in a CLI install context.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Confirm the install script is reachable:

bash

curl -I 'https://dtaiagtavtr.antdigital.com/agentar-cli/install.sh'

Prefer the public production install script for user-facing installation:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The command curl -fsSL 'https://dtaiagtavtr.antdigital.com/agentar-cli/install.sh' | bash executes remote network content directly in a shell, creating a classic arbitrary code execution path. In this skill's context, the instruction is especially dangerous because it is presented as the preferred production installation workflow, making copy-paste execution highly likely.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Prefer the public production install script for user-facing installation:

bash

curl -fsSL 'https://dtaiagtavtr.antdigital.com/agentar-cli/install.sh' | bash

The installer places the binary under /tmp/agentar-cli/bin by default. Verify with the absolute path first:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The quick reference directs users to fetch and trust an external installer from a remote domain, creating a supply-chain risk if the host, DNS, TLS termination, or distribution pipeline is compromised. Because the skill is specifically about installing and delegating to a CLI, external script fetching is central to the workflow and therefore materially increases the blast radius of any compromise.

Content

Scanner excerpt · references/agentar-cli-quick-reference.md (reported line 25)May include surrounding context.

Confirm the installer is reachable:

bash

curl -I 'https://dtaiagtavtr.antdigital.com/agentar-cli/install.sh'

Install from the public production script:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The curl ... | bash chain is a classic unsafe execution pattern that combines network retrieval and shell execution in a single step, eliminating meaningful inspection and magnifying compromise risk. In an agent skill, this is especially dangerous because users may execute the exact command on trust, and an attacker controlling the upstream content gains arbitrary code execution on the host.

Content

Scanner excerpt · references/agentar-cli-quick-reference.md (reported line 31)May include surrounding context.

Install from the public production script:

bash

curl -fsSL 'https://dtaiagtavtr.antdigital.com/agentar-cli/install.sh' | bash

Verify the default binary path:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says to use the skill for broad requests such as 'research documents,' 'tables,' 'generating images,' and 'troubleshooting ordinary Agentar CLI usage' without defining specific trigger phrases or exclusion conditions. In a markdown/manifest context, this can cause unintended activation because many of these phrases are common user intents rather than narrow invocation cues.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage criteria include very general tasks like 'Generate images' and 'Create videos,' which are not inherently specific to Agentar and could match ordinary conversation. Although there is one exclusion at L038, the section still lacks enough specificity to reliably distinguish Agentar-specific requests from general creative tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx skills add OpenAgentar/agentar-skills without pinning a specific version, commit, or integrity value. This makes the installation non-reproducible and exposes users to supply-chain risk if the referenced package or its resolution path is modified or compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The troubleshooting guidance repeats the same unpinned npx skills add OpenAgentar/agentar-skills command, reintroducing the same supply-chain exposure during remediation steps. Users often copy-paste troubleshooting commands with less scrutiny, increasing practical risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Piping a remotely fetched script directly into bash executes unreviewed code from the network with no integrity verification, no signature/hash validation, and no opportunity for user inspection. In this skill context, the danger is elevated because the file is framed as an authoritative quick-reference workflow, encouraging copy-paste execution of a high-risk pattern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document instructs users to pass API keys on the command line and perform networked authentication without warning that command-line secrets may be exposed through shell history, process listings, CI logs, or copied transcripts. In a skill context, this is more dangerous because users may paste commands verbatim and agents may echo them into logs or terminal histories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The smoke-test section provides only a Chinese prompt (使用 agentar skill...) as the triggering request, which imposes a specific language in the usage guidance. The file does not offer an alternative language example or explain that Chinese is required for a region-specific reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.