happyhorse

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 0.2.9

Overview

The skill is coherent for RunAPI video generation, but it installs an unpinned third-party CLI from a custom Homebrew tap and then uses it with authentication and local media.

Review the RunAPI CLI source/provenance before installing, prefer a pinned and verified version if available, and only provide RunAPI credentials or local media you intend to send to the service. Download generated files into a controlled output directory and validate the source and file type before opening them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party CLI Installation from a Custom Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-17
Vulnerability Type: Unpinned third-party dependency from a mutable package source
Risk Level: Medium

Vulnerable Code

yaml

install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

Technical Analysis

The skill declares installation of the runapi executable from the custom Homebrew tap runapi-ai/tap without pinning a reviewed version, release artifact, checksum, signature, or source commit. The audited project does not include the Homebrew formula or the CLI source code, so the executable installed through this instruction cannot be statically verified as part of the skill review.

Because the package reference is mutable, its effective code can change after this skill has been audited. A compromise of the tap, its release infrastructure, or its maintainer account could cause subsequent installations to retrieve and execute attacker-controlled code.

The resulting CLI is especially security-sensitive because the skill directs it to process RunAPI authentication state and user-selected local media. This finding concerns dependency provenance and mutability; the audit found no evidence that the current package is malicious.

Attack Path

1. An attacker compromises the custom Homebrew tap, its maintainer account, or an upstream release artifact referenced by its formula.
2. The attacker publishes a modified formula or executable under the existing runapi-ai/tap/runapi package name.
3. An agent following the skill installs the dependency without validating a pinned version, checksum, or cryptographic signature.
4. Homebrew installation hooks or a later runapi invocation execute the attacker-controlled payload with the permissions of the agent's operating-system account.
5. The payload can access data available to that process, potentially including RunAPI authentication material, saved CLI configuration, request data, and local media selected for ...[truncated 640 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version rather than installing the mutable latest package.
2. Reference an immutable release artifact or source commit and verify its published cryptographic checksum or signature before installation.
3. Document the canonical source repository and trusted release-signing identity so provenance can be independently validated.
4. Pin the custom tap itself to a reviewed commit where the installation mechanism supports it.
5. Refuse automatic installation when the expected version, checksum, signature, or source provenance cannot be verified.
6. Run the CLI with least privilege and restrict its access to credentials and local files not required for the current task.
7. Periodically review dependency updates before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to fetch remote deliverables with curl and save them locally, but it does not require any user confirmation, destination restrictions, or warning that this performs external network access and writes files to disk. In an agent setting, that can lead to unexpected outbound requests and local file creation from untrusted URLs returned by a third-party service, increasing the risk of unsafe content retrieval or accidental handling of malicious files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.