Corust Agent Configure

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:19 AM UTC
• Version: 1.0.0

Overview

The skill matches its stated purpose, but it asks users to install an unverified remote agent binary and configure broad automatic and Discord-accessible agent permissions.

Review carefully before installing. Prefer a pinned, verified Corust release, avoid approve-all unless you fully trust the agent and environment, and replace the Discord wildcard with explicit trusted users, roles, channels, or guilds.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:48

Finding

Unverified Mutable Executable Is Downloaded and Executed

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:124

Finding

Downloaded Agent Is Granted an Excessive Approve-All Permission Policy

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:148

Finding

Wildcard Discord Authorization Allows Untrusted Users to Spawn Agent Sessions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

-o /tmp/corust-agent.tar.gz tar -xzf /tmp/corust-agent.tar.gz -C "$HOME/corust" chmod +x "$HOME/corust/corust-agent-acp" rm /tmp/corust-agent.tar.gz

text

Adjust the archive name based on detected platform:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash

   # Example for macOS Apple Silicon
   mkdir -p "$HOME/corust"
   curl -fSL "https://github.com/Corust-ai/corust-agent-release/releases/latest/download/agent-darwin-arm64.tar.gz" \
     -o /tmp/corust-agent.tar.gz
   tar -xzf /tmp/corust-agent.tar.gz -C "$HOME/corust"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Configuring the ACPX plugin with permissionMode set to approve-all disables interactive approval and grants the agent broad automatic permission to perform actions. For a coding agent reachable via chat, this materially increases the chance that prompt injection, misuse, or operator mistakes lead to unintended file, command, or network actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill recommends permissionMode: "approve-all" but does not explain that this removes a key safety checkpoint for agent actions. Without a warning, operators may unknowingly deploy an auto-executing agent configuration that is unsafe for general use, especially when coupled with chat-based triggering.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs setting channels.discord.allowFrom to ["*"], which broadly permits requests from any Discord source/DM context rather than limiting access to trusted users, roles, or channels. In the context of installing and exposing a coding agent, this unnecessarily widens the attack surface and can allow untrusted users to trigger agent sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells users to enable unrestricted Discord access without warning that this may expose the agent to unsolicited DMs or untrusted users. Omitting that warning makes unsafe deployment more likely because users may copy the configuration verbatim without understanding the access-control consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.