Statichub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:52 AM UTC
• Version: 0.1.0

Overview

This deployment skill is mostly straightforward, but it tells the agent to install its CLI by running an unpinned remote shell script directly from GitHub.

Review this skill before installing. The deploy workflow is narrow, but do not let an agent run the one-line remote installer automatically; install StaticHub from a pinned release or package source, verify checksums/signatures where available, and approve any local binary installation explicitly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20

Finding

Unpinned Remote Installer Executed Directly Through a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-24
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

markdown

1. Check CLI:
   - `command -v statichub`
   - `statichub --help`
   - If missing, install with one line:
     - `curl -sSL https://raw.githubusercontent.com/Patrick0308/statichub/main/scripts/install.sh | sh`

Technical Analysis

The Skill instructs the agent to retrieve an installation script from a personal GitHub repository's mutable main branch and pipe it directly into sh. The downloaded content is therefore executed before it can be reviewed.

The instruction does not pin the script to a reviewed commit or release and does not verify a cryptographic checksum or signature. Consequently, the effective installer can change after this Skill has been audited. Compromise of the repository, maintainer account, or upstream delivery process could substitute arbitrary shell commands. The -s option also suppresses normal curl progress and error output, reducing visibility during installation.

Installing the required CLI can support the declared deployment functionality, but immediate execution of mutable remote content is not the least-risk or minimum-privilege installation method.

Attack Path

1. The agent checks for statichub and determines that it is absent.
2. Following SKILL.md, it requests the installer from the repository's mutable main branch.
3. An attacker who controls or compromises the repository, maintainer account, or upstream content replaces the installer with malicious shell commands.
4. The pipeline sends the response directly to sh without local inspection, version pinning, checksum validation, or signature verification.
5. The malicious commands execute with the privileges of the user or agent running the Skill.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's privileges. D ...[truncated 389 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | sh pipeline.
2. Prefer installation from a trusted package manager using an explicitly pinned version.
3. If a standalone installer is required:
   • Pin its URL to a reviewed immutable commit or release artifact.
   • Download it to a local file without executing it.
   • Verify a publisher-provided cryptographic checksum and, preferably, a trusted digital signature.
   • Review the downloaded script and disclose the commands and filesystem changes it will perform.
   • Require explicit user approval before execution.
4. Run installation with ordinary user privileges and avoid sudo unless a documented operation strictly requires it.
5. Fail closed on download or verification errors; use curl options such as --fail --show-error --location.
6. Document the expected binary destination, files modified, network endpoints contacted, and uninstall procedure.

A safer general workflow is:

sh

curl --fail --show-error --location \
  --output /tmp/statichub-install.sh \
  'https://raw.githubusercontent.com/Patrick0308/statichub/<reviewed-commit>/scripts/install.sh'

printf '%s  %s\n' '<trusted-sha256>' '/tmp/statichub-install.sh' | sha256sum --check -
sh /tmp/statichub-install.sh

The immutable commit and checksum must come from a separately authenticated, trusted source.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs fetching and executing a remote shell script with curl ... | sh, which bypasses review of the downloaded code and gives that script immediate execution in the user's environment. In an agent skill context, this is especially dangerous because it normalizes automatic execution of unaudited installer code from a mutable remote source, enabling supply-chain compromise or arbitrary code execution if the source is tampered with.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

This command retrieves a shell script from GitHub and pipes it directly into sh, creating a direct remote-code-execution path controlled by external content. Because the URL points to a branch path rather than an immutable artifact, the fetched script can change over time, increasing the risk of malicious updates, repository compromise, or accidental harmful changes being executed automatically.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

- `command -v statichub`
   - `statichub --help`
   - If missing, install with one line:
     - `curl -sSL https://raw.githubusercontent.com/Patrick0308/statichub/main/scripts/install.sh | sh`
2. Validate `<path>` exists and is valid.
3. Run deploy:
   - Named: `statichub deploy <path> --name <project>`

Static analysis

No suspicious patterns detected.