firmenbuchat

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:45 AM UTC
• Version: 0.2.3

Overview

This skill is a small, coherent command reference for a Firmenbuch CLI, with ordinary API-key setup and no hidden execution or persistence in the reviewed artifact.

Before installing, review the referenced firmenbuchat package source or tap, prefer a pinned or reviewed version when possible, and keep the Firmenbuch API key out of committed files, logs, and shared shell history.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:6

Finding

Unpinned Third-Party Installation Sources

Content

View full analysis

Vulnerability Details

File Location: skill.md, line 6
Vulnerability Type: Unpinned and remotely mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🇦🇹","requires":{"bins":["firmenbuchat"]},"install":[{"id":"brew","kind":"brew","formula":"pasogott/tap/firmenbuchat","bins":["firmenbuchat"],"label":"Install firmenbuchat (brew)"},{"id":"uv","kind":"shell","command":"uv add git+https://github.com/pasogott/firmenbuch-aip.git","label":"Install firmenbuchat (uv)"}]}}

Technical Analysis

The uv installation command retrieves the package directly from a Git repository without specifying an immutable commit hash or a pinned release tag. Consequently, the installed content depends on the repository's mutable default branch and may differ from the content present when this skill was reviewed.

The Homebrew installation also relies on the third-party tap pasogott/tap without documenting a pinned package version, immutable formula revision, or independently verified integrity value. Although use of a third-party package source is not inherently malicious, the absence of immutable version pinning and integrity controls increases supply-chain exposure.

This finding does not establish that the referenced project or publisher is malicious. It identifies that subsequent installations can consume remotely changed content that was not included in the audited artifact.

Attack Path

1. An attacker compromises the referenced GitHub repository, its publisher account, a maintainer credential, or the third-party Homebrew tap.
2. The attacker modifies the package source, build configuration, or formula to include malicious installation or runtime behavior.
3. A user or agent follows the installation metadata in skill.md.
4. uv retrieves the current repository content, or Homebrew retrieves the current third-party formula and package content.
5. The packag ...[truncated 1000 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the Git dependency to a reviewed immutable commit hash, for example by using the package manager's supported commit-reference syntax.
• Prefer a signed, versioned release rather than installing from a mutable default branch.
• Document the expected package version and verify release signatures or cryptographic hashes before installation.
• Use a versioned Homebrew formula containing verified source checksums, and review changes to the third-party tap before upgrades.
• Apply dependency update controls so that changes are reviewed and tested before the pinned revision is advanced.
• Run installation and the resulting CLI with least privilege; do not use an administrator account unless strictly required.
• Provide API credentials only at runtime and scope them to the minimum necessary permissions. Avoid exposing credentials to installation hooks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 14)May include surrounding context.

md

Setup (API-Key)
- `firmenbuchat config set-key`
- `export FIRMENBUCH_API_KEY="dein-key"`
- `.env`: `cp .env.example .env` und dann `firmenbuchat --env-file /pfad/zu/.env <command>`

Hilfe (alle Commands)
- `firmenbuchat help`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown includes multiple ways to provide the Firmenbuch API key, including exporting it as an environment variable and passing an env file path, but it provides no warning about handling secrets safely. Because this skill interacts with credentials, the description should disclose the risk of exposing API keys in shell history, shared env files, or logs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.