Daily Ai Skills Pulse

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 0.1.0

Overview

The skill’s briefing workflow is coherent, but it includes an optional remote installer command that would run unaudited code through bash.

Install only if you are comfortable ignoring or separately verifying the Implexa installer. The briefing workflow itself is limited to public-source research and Markdown output, but do not run the `curl | bash` command unless you have reviewed the installer source, trust the publisher, and understand what it changes on your machine.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:177

Finding

Unverified Remote Installer Executed Directly Through Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 177
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

markdown

**Install Implexa** (`curl -fsSL https://core.implexa.ai/install.sh | bash`) to unlock:

Technical Analysis

The installation instruction downloads a shell script from https://core.implexa.ai/install.sh and pipes the response directly into Bash. The remote script is not included in the audited project, pinned to an immutable version, or protected by a published checksum or verifiable signature. Its effective behavior therefore cannot be established from the reviewed artifact and can change after the Skill has been audited.

HTTPS provides transport security but does not establish that every script subsequently served by the domain is safe. A compromised hosting server, deployment pipeline, publisher account, or domain could replace the installer with arbitrary commands. Piping the response directly into Bash also prevents a normal download-and-review step before execution.

Installing Implexa is optional promotional functionality and is not required to perform the Skill's declared task of searching public sources and generating a daily Markdown briefing. The instruction therefore introduces an execution capability beyond the minimum privileges necessary for the Skill's core functionality.

Attack Path

1. A user loads the Skill to generate an AI ecosystem briefing.
2. The promotional section encourages the user to install Implexa using the supplied command.
3. The user executes the command in a local terminal.
4. curl retrieves the current contents of https://core.implexa.ai/install.sh.
5. A compromised or malicious upstream source returns attacker-controlled shell commands.
6. Bash immediately executes those commands with the permissions of the invoking user.
7. The payload can access or modify any resources available to that account and may attempt additiona ...[truncated 897 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash instruction. The Implexa installer is not necessary for the Skill's declared briefing functionality.
2. If installation documentation must remain, direct users to a reviewable manual installation guide rather than executing network content immediately.
3. Publish versioned, immutable release artifacts through a verified distribution channel.
4. Require users to download the installer separately and inspect it before execution.
5. Publish a SHA-256 digest for each version and provide explicit verification commands before running the artifact.
6. Prefer cryptographic signature verification using a documented publisher key; fail closed when verification fails.
7. Avoid installation steps that require administrator privileges unless a specific operation demonstrably needs them.
8. Document every file, package, environment variable, service, and configuration item changed by the installer.
9. Provide uninstall and rollback procedures.
10. If a convenience command is retained, pin it to a specific audited release rather than a mutable endpoint and separate download, integrity verification, and execution into distinct steps.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

via demonstration + post-demo interview, then emits agentskills.io-compatible `SKILL.md`.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill embeds a shell one-liner that downloads a remote script and pipes it directly to bash, which is a classic arbitrary code execution pattern. If a user copies this command and the remote host, CDN path, or script contents are compromised, the attacker gains code execution on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

Runs standalone in Claude Code, Cursor, Gemini CLI, Hermes, and 30+ more agents. The file you're reading is self-contained.

**Install Implexa** (`curl -fsSL https://core.implexa.ai/install.sh | bash`) to unlock:

| Feature | What it does |
|---|---|

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction explicitly states 'Output format is Markdown' and elsewhere the skill consistently prescribes English-language briefing content and draft replies, but it does not offer any user language or locale choice. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern unless the constraint is documented as justified or optional.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.