T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:33- Finding
Mutable Remote Installation Script Is Executed Directly by Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
agentbook
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for Agentbook messaging, but it combines wallet and credential capabilities with mutable install/update paths and broad agent installation guidance that need review before use.
Review this skill carefully before installing. Prefer pinned, checksummed release artifacts over curl-to-bash, avoid update --yes, install only into the agent you actually use, and do not enable yolo wallet or background credential services unless you understand the wallet spending and credential exposure model.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:14- Finding
Executable Archives Are Downloaded Through Mutable Latest-Release URLs Without Integrity Metadata
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:332- Finding
Skill Installation Executes Unpinned Package Tooling and References Mutable Upstream Content
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The
| bashconstruct chains network retrieval directly into command execution, eliminating the opportunity to inspect the payload before it runs. This is dangerous because any malicious or altered response becomes instant shell code with the user's privileges.- Content
bash # Install pre-built binaries (recommended) curl -fsSL https://raw.githubusercontent.com/ardabotai/agentbook/main/install.sh | bash # Or self-update if already installed agentbook update
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The skill documents a self-update path for the installed tool, meaning future code can change outside the reviewed skill contents. In combination with wallet, messaging, and smart-contract functionality, self-modifying tooling substantially increases the blast radius of an upstream compromise or malicious release.
- Content
Install pre-built binaries (recommended)
curl -fsSL https://raw.githubusercontent.com/ardabotai/agentbook/main/install.sh | bash
Or self-update if already installed
agentbook update
text
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The dedicated self-update section normalizes fetching and installing the latest release from GitHub without pinning or artifact verification. That creates a strong supply-chain risk because the executable may materially change after review while retaining the same privileged role in agent workflows.
- Content
Requires 1Password CLI for non-interactive authentication. Without it, use
agentbook upfor interactive startup.Self-update
bash agentbook update # Check for and install latest release from GitHub
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description says to use the skill whenever 'interacting with agentbook,' which is broad and lacks explicit limits around high-risk actions like sending messages, managing wallets, or calling smart contracts. Overbroad activation increases the chance an agent invokes the skill in contexts the user did not intend, especially where funds or sensitive communications are involved.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installation section recommends
curl ... | bash, which executes remote script contents immediately without review, checksum verification, or version pinning. This is a classic high-risk supply-chain pattern because any compromise of the source, network path, or referenced script can lead to arbitrary code execution.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
bash agentbook update # Check for and install latest release from GitHub agentbook update --yes # Skip confirmation promptIdentity
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 85% confidence
- Finding
The skill instructs users to run
npx skillswithout pinning an exact package version, so the executed code may change over time or be replaced by a compromised upstream release. In a security-sensitive skill that also manages messaging, wallets, and contract interactions, this weakens supply-chain integrity and reproducibility.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 85% confidence
- Finding
This invocation again relies on
npx skillswithout an explicit version, which causes live code retrieval at execution time from the npm ecosystem. If the package is updated maliciously or the publisher account is compromised, users may execute unintended code.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 85% confidence
- Finding
Unpinned
npx skillsintroduces a supply-chain risk because the package contents are not fixed and may differ between executions. Since this skill is meant for broad installation into agent environments, a compromised dependency could gain significant execution privileges.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 85% confidence
- Finding
The command fetches and executes the latest package version implicitly, which is unsafe for a skill distributed to automation-capable agents. The context makes this more dangerous because the installed skill can influence agent behavior around messaging and wallet operations.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 85% confidence
- Finding
Using
npx skillswithout version pinning leaves users exposed to upstream package drift or compromise. In an agent-skill ecosystem, that risk extends beyond a one-time install because the resulting skill may shape future privileged actions.- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
This line fetches a script from a remote URL and pipes it directly into a shell, enabling immediate arbitrary code execution from external content. The risk is amplified here because the installed software can later handle credentials, network messaging, and blockchain transactions.
- Content
bash # Install pre-built binaries (recommended) curl -fsSL https://raw.githubusercontent.com/ardabotai/agentbook/main/install.sh | bash # Or self-update if already installed agentbook update
Static analysis
No suspicious patterns detected.