Security audit
Security checks for vulnerabilities and agentic risk
This Maxun skill appears to be a real service integration, but it requests excessive local execution authority and includes unsafe helper-script behavior that users should review before installing.
Review this skill before installing. Use it only with a narrowly scoped execution policy, keep approval prompts on for run and abort actions, avoid running it from directories containing untrusted .env files, and do not allow arbitrary MAXUN_BASE_URL values to receive your Maxun API key.
scripts/maxun.sh:43Arbitrary Python Code Execution Through Unsafe Limit Interpolation
scripts/maxun.sh:14Arbitrary Shell Execution Through Automatic Sourcing of Working-Directory .env
scripts/maxun.sh:20Maxun API Key Disclosure Through Unrestricted Base URL Override
SKILL.md:93Unrestricted Gateway Command Execution with User Approval Disabled
The setup directs users to enable the exec tool with security: full, which grants unrestricted shell execution for a skill that only needs to interact with a specific service. This broadens the blast radius from a scoped API integration to arbitrary command execution if the skill is abused, modified, or combined with prompt injection.
The setup disables execution confirmation (ask: off) while the skill can run and abort scraping jobs, removing an important human-in-the-loop safeguard. If the skill is invoked mistakenly or influenced by untrusted content, commands can execute immediately without user awareness or approval.
The script sources a local .env file as shell code, not as passive configuration. If an attacker can modify .env in the working directory, they can achieve arbitrary command execution when the skill runs, and the auto-export behavior can also expose unexpected variables to subprocesses.
set -euo pipefail
if [ -f .env ]; then
set -a
source .env
set +a
The .env loading block exports all variables from a locally sourced file into the environment of curl and python3 subprocesses. In the context of an agent skill, this increases risk because untrusted workspace content can influence execution and propagate attacker-controlled environment variables into downstream tools.
if [ -f .env ]; then
set -a
source .env
set +a
fi
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
AUTH_HEADER="x-api-key: $API_KEY"
_get() {
curl -sf -H "$AUTH_HEADER" -H "Content-Type: application/json" "$BASE_URL$1"
}
_post() {
The skill invokes shell execution via the exec tool but does not declare a restrictive tool scope such as allowed-tools or permissions boundaries. That creates ambiguity about what the skill is allowed to execute and increases the risk that prompt-driven behavior or future edits could expand into arbitrary command execution beyond the intended Maxun wrapper commands.
The trigger description is broad enough that common phrases about scraping or robots may invoke the skill unexpectedly, increasing the chance of unintended execution. In a skill that can launch or abort jobs, over-invocation raises the risk of unauthorized actions or unnecessary data collection.
The documentation adds an abort capability that is not reflected in the manifest description or argument hint, so the skill can perform a more destructive action than users and orchestrators would reasonably expect. Hidden or under-declared capabilities weaken reviewability and can lead to accidental invocation of state-changing operations.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Error Handling
- No robots found → tell user to create one at https://app.maxun.dev
- Robot still running → call exec with `maxun result <robotId> <runId>`
## Setup (for new installations)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
AUTH_HEADER="x-api-key: $API_KEY"
_get() {
curl -sf -H "$AUTH_HEADER" -H "Content-Type: application/json" "$BASE_URL$1"
}
_post() {
The abort command triggers an irreversible action against an in-progress run via a POST request, but this path has no confirmation prompt and no user-facing warning near the operation itself. While the command name implies stopping a run, the code does not disclose the impact at execution time beyond the terse usage label.
No suspicious patterns detected.