T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:31- Finding
Unpinned Remote Executables Installed from Mutable Third-Party Releases
- Content
View full analysis
- Remediation
View remediation
Security audit
Noisepan Digest
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for automated news digests, but it asks users to install mutable third-party binaries and set up persistent local automation with some weak safety controls.
Install only if you are comfortable reviewing shell commands first. Prefer Homebrew or pinned, verified releases; avoid writing to /usr/local/bin unless you explicitly want a system-wide install; bind any temporary HTTP server to 127.0.0.1; use private mktemp directories; and review or remove the ~/.local/bin helpers and cron jobs when no longer needed.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:31- Finding
Checksum Verification Targets a Filename Different from the Downloaded Archive
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:126- Finding
Predictable Temporary Directories and Non-Loopback Temporary HTTP Server
- Content
View full analysis
~/.local/bin/noisepan-pull << 'SCRIPT' #!/bin/bash # Prefetch Reddit RSS sequentially to avoid rate limiting, then run noisepan pull CACHE_DIR="/tmp/reddit-rss-cache" CONFIG_DIR="${HOME}/.noisepan" UA="Mozilla/5.0 (compatible; noisepan/1.0)" mkdir -p "$CACHE_DIR" FEEDS=$(grep "reddit.com" "$CONFIG_DIR/config.yaml" | grep -v "^#" | grep -v "^ #" | sed 's/.*"\(.*\)"/\1/') for feed in $FEEDS; do sub=$(echo "$feed" | grep -oP '/r/\K[^/]+') curl -s -o "$CACHE_DIR/${sub}.xml" -H "User-Agent: $UA" "$feed" sleep 2 done python3 -m http.server 18222 --directory "$CACHE_DIR" &>/dev/null & HTTP_PID=$!; sleep 0.5 mkdir -p /tmp/noisepan-tmp cp "$CONFIG_DIR/config.yaml" /tmp/noisepan-tmp/config.yaml for feed in $FEEDS; do sub=$(echo "$feed" | grep -oP '/r/\K[^/]+') sed -i "s|$feed|http://localhost:18222/${sub}.xml|" /tmp/noisepan-tmp/config.yaml done ln -sf "$CONFIG_DIR/taste.yaml" /tmp/noisepan-tmp/taste.yaml ln -sf "$CONFIG_DIR/noisepan.db" /tmp/noisepan-tmp/noisepan.db noisepan pull --config /tmp/noisepan-tmp "$@" kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp SCRIPT ``` ### Technical Analysis The wrapper uses fixed, globally predictable paths under `/tmp`: `/tmp/reddit-rss-cache` and `/tmp/noisepan-tmp`. On a multi-user system, another local user can pre-create or manipulate these locations before the wrapper runs. Because the code does not validate ownership, file type, or permissions, pre-existing directories, files, or symbolic-link arrangements can influence where content is written and what configuration is consumed. The cache server is started with `python3 -m http.server 18222` without `--bind 127.0.0.1`. Python's HTTP server normally listens on all available interfaces, even though the generated configur ...[truncated 2066 chars]- Remediation
View remediation
/dev/null 2>&1 & ``` 3. Register cleanup immediately after creating resources: ```bash HTTP_PID="" cleanup() { if [ -n "$HTTP_PID" ]; then kill "$HTTP_PID" 2>/dev/null || true wait "$HTTP_PID" 2>/dev/null || true fi rm -rf -- "$WORK_DIR" } trap cleanup EXIT INT TERM ``` 4. Use a dynamically selected available loopback port rather than a fixed port where practical. 5. Validate temporary paths and reject symbolic links or objects not owned by the current user. 6. Apply restrictive permissions with `umask 077`. 7. Quote and safely parse feed values rather than iterating over shell word splitting. 8. Ensure server startup succeeded before rewriting the configuration and invoking `noisepan`. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # Verify checksum grep linux_amd64 /tmp/noisepan-checksums.txt | (cd /tmp && sha256sum -c) tar xzf /tmp/noisepan.tar.gz -C /usr/local/bin noisepan rm /tmp/noisepan.tar.gz /tmp/noisepan-checksums.txt # entropia VER=$(curl -s https://api.github.com/repos/ppiankov/entropia/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # Verify checksum grep linux_amd64 /tmp/entropia-checksums.txt | (cd /tmp && sha256sum -c) tar xzf /tmp/entropia.tar.gz -C /usr/local/bin entropia rm /tmp/entropia.tar.gz /tmp/entropia-checksums.txt # Verify both noisepan version && entropia version
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
ln -sf "$CONFIG_DIR/noisepan.db" /tmp/noisepan-tmp/noisepan.db
noisepan pull --config /tmp/noisepan-tmp "$@" kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp SCRIPT mkdir -p ~/.local/bin && chmod +x ~/.local/bin/noisepan-pull
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
ln -sf "$CONFIG_DIR/noisepan.db" /tmp/noisepan-tmp/noisepan.db
noisepan pull --config /tmp/noisepan-tmp "$@" kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp SCRIPT mkdir -p ~/.local/bin && chmod +x ~/.local/bin/noisepan-pull
text
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
ln -sf "$CONFIG_DIR/noisepan.db" /tmp/noisepan-tmp/noisepan.db
noisepan pull --config /tmp/noisepan-tmp "$@" kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp SCRIPT mkdir -p ~/.local/bin && chmod +x ~/.local/bin/noisepan-pull
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # noisepan VER=$(curl -s https://api.github.com/repos/ppiankov/noisepan/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v) curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/noisepan_${VER}_linux_amd64.tar.gz" -o /tmp/noisepan.tar.gz curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/checksums.txt" -o /tmp/noisepan-checksums.txt # Verify checksum
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # noisepan VER=$(curl -s https://api.github.com/repos/ppiankov/noisepan/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v) curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/noisepan_${VER}_linux_amd64.tar.gz" -o /tmp/noisepan.tar.gz curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/checksums.txt" -o /tmp/noisepan-checksums.txt # Verify checksum
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The skill directs creation of a persistent executable wrapper under ~/.local/bin/noisepan-pull, which alters future user behavior and remains available beyond the immediate session. Persistent helper scripts are risky because they can be invoked later with inherited trust, especially when they perform network access, file rewrites, local serving, and cleanup operations.
- Content
Reddit Rate Limiting
With 15+ Reddit feeds, parallel fetching triggers 429s. Create a sequential prefetch wrapper:
bash cat > ~/.local/bin/noisepan-pull << 'SCRIPT'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs users to create persistent local scripts, modify files under ~/.local/bin and ~/.noisepan, create symlinks, run a local HTTP server, write temporary files under /tmp, and configure cron automation, but it does not present a clear consolidated warning about these side effects. In a skill meant to be followed by an agent or user, this increases the chance of unreviewed system modifications and persistent automation being applied without informed consent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
Marking the created wrapper executable in ~/.local/bin finalizes persistence and makes the helper available on the user's PATH for repeated use. In the context of an agent skill, persistent PATH modifications are more dangerous because they can normalize execution of unreviewed local code in later sessions.
- Content
noisepan pull --config /tmp/noisepan-tmp "$@" kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp SCRIPT mkdir -p ~/.local/bin && chmod +x ~/.local/bin/noisepan-pull
text Use `noisepan-pull` instead of `noisepan pull` when you have 15+ Reddit feeds.