bearware-teamtalk

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a TeamTalk SDK knowledge and build helper, but its build workflow can fetch mutable remote code and run repository-defined commands with sudo on the host.

Install only if you want a TeamTalk SDK reference and are comfortable reviewing any setup commands before use. Do not run the build/setup scripts on a sensitive machine without inspecting the cloned repository, pinning or verifying the source revision, and avoiding sudo execution of repository Makefiles; prefer an isolated container or VM.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/build_from_source.sh:5

Finding

Mutable Remote Repository Code Is Executed with Root Privileges

Content

View full analysis

/dev/null; then UBUNTU_VER=$(grep VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"' | tr -d '.') echo "Installing deps for Ubuntu $UBUNTU_VER..." sudo make -C Build depend-ubuntu${UBUNTU_VER} || \ sudo make -C Build depend-ubuntu22 echo "Building..." make -C Build ubuntu${UBUNTU_VER} || make -C Build ubuntu22 elif grep -qi debian /etc/os-release 2>/dev/null; then sudo make -C Build depend-raspios12 make -C Build raspios12 ``` ### Technical Analysis The build script clones code from a mutable Git branch and immediately executes Makefile targets supplied by the downloaded repository. It does not pin the source to a reviewed commit, verify a signed commit or tag, or validate the downloaded content against a trusted checksum. Both `REPO_URL` and `BRANCH` are inherited from environment variables. A caller capable of influencing the script environment can redirect the clone to an attacker-controlled repository. Even without environment manipulation, compromise or malicious modification of the upstream mutable branch would alter ...[truncated 2439 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill references and instructs use of local scripts such as scripts/check_sdk.py and scripts/build_from_source.sh, which implies file/system interaction, but it does not declare any permissions or allowed-tools scope. This creates an authorization ambiguity where an agent may be induced to access local files or run local helper scripts without an explicit capability boundary, increasing the risk of unintended file access or execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The build section includes commands that install dependencies, invoke Docker, clone remote code, and modify the local development environment, including privileged package setup, without any explicit warning that these actions change the host system. In an agent skill context, presenting such commands as routine steps can lead to unsafe execution on a user's machine without informed consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill explicitly recommends sudo make -C Build depend-ubuntu24, which runs a Makefile target with elevated privileges. Because Make targets can execute arbitrary shell commands and may change packages or system configuration, encouraging sudo execution is risky in a reusable agent skill, especially without explaining trust assumptions or requiring confirmation.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

cd TeamTalk5

# Install dependencies then build
sudo make -C Build depend-ubuntu24
make -C Build ubuntu24

# macOS

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents operations that open the microphone, start webcam transmission, start desktop sharing, send desktop input, and store audio to disk, but it provides no warning about privacy, recording, or device-access implications. Under the markdown-specific SQP-2 criteria, descriptions of behaviors that can affect user privacy or system integrity should disclose those impacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The document describes uploading/downloading/removing files, recording audio to files, creating/deleting user accounts, deleting channels, and saving server configuration, but it does not warn readers that these actions can modify or remove user data or server state. For markdown files, omission of warnings for behaviors affecting user data or system integrity is in scope for SQP-2.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

sudo make -C Build depend-ubuntu${UBUNTU_VER} executes a repository-controlled Make target with root privileges. If the cloned repository, selected branch, or local checkout is malicious or compromised, the Makefile can run arbitrary commands as root, leading to full system compromise.

Content

Scanner excerpt · scripts/build_from_source.sh (reported line 46)May include surrounding context.

sh

if grep -qi ubuntu /etc/os-release 2>/dev/null; then
            UBUNTU_VER=$(grep VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"' | tr -d '.')
            echo "Installing deps for Ubuntu $UBUNTU_VER..."
            sudo make -C Build depend-ubuntu${UBUNTU_VER} || \
                sudo make -C Build depend-ubuntu22
            echo "Building..."
            make -C Build ubuntu${UBUNTU_VER} || make -C Build ubuntu22

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script invokes privileged dependency installation through sudo make without an explicit confirmation or a clear warning that system packages and host state will be modified. In a build helper that pulls code from a remote repository, this increases risk because Makefile targets executed with elevated privileges can perform broad system changes if the repository or branch is untrusted or compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The fallback sudo make -C Build depend-ubuntu22 has the same core issue: it grants root privileges to commands defined in project Makefiles fetched from a remote repository. This creates a high-impact supply-chain risk because an attacker controlling the source or branch contents could execute arbitrary privileged commands.

Content

Scanner excerpt · scripts/build_from_source.sh (reported line 47)May include surrounding context.

sh

UBUNTU_VER=$(grep VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"' | tr -d '.')
            echo "Installing deps for Ubuntu $UBUNTU_VER..."
            sudo make -C Build depend-ubuntu${UBUNTU_VER} || \
                sudo make -C Build depend-ubuntu22
            echo "Building..."
            make -C Build ubuntu${UBUNTU_VER} || make -C Build ubuntu22
        elif grep -qi debian /etc/os-release 2>/dev/null; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

sudo make -C Build depend-raspios12 similarly executes Makefile logic as root for Debian-based systems. Because the script clones or updates code from GitHub immediately before this step, the trust boundary is weak and the privileged execution materially increases the danger of supply-chain compromise.

Content

Scanner excerpt · scripts/build_from_source.sh (reported line 51)May include surrounding context.

sh

echo "Building..."
            make -C Build ubuntu${UBUNTU_VER} || make -C Build ubuntu22
        elif grep -qi debian /etc/os-release 2>/dev/null; then
            sudo make -C Build depend-raspios12
            make -C Build raspios12
        else
            echo "Unsupported Linux distro. Trying direct CMake build..."

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script automatically runs git pull --depth 1 on an existing checkout, which modifies the local source tree through network-fetched content without an explicit warning or opt-in. This can unexpectedly change the user's working copy, discard assumptions about build reproducibility, and expose subsequent build steps to newly fetched code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.