Setup Cairo Contracts

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:46 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for setting up Cairo contracts, but it tells users to execute a live remote installer directly in the shell without verification.

Review this skill before installing. Its Cairo/OpenZeppelin guidance is straightforward, but do not copy the remote installer command blindly; use an official, pinned, and verifiable installation method or download and verify the installer before running it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Unverified Remote Installer Executed Directly by Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Complete Code Snippet:

bash

curl --proto '=https' --tlsv1.2 -sSf https://sh.starkup.sh | sh

Technical Analysis

The installation instructions download a remote script and pipe its response directly into sh. The downloaded content is therefore executed immediately without local inspection, version pinning, cryptographic checksum verification, or publisher-signature validation.

The HTTPS and TLS options provide transport protection but do not guarantee that the server will always return the same trusted payload. The effective executable content can change after this Skill has been reviewed. The installer is not included in the project, so its commands and side effects cannot be assessed through this static audit.

Installing a Cairo/Starknet toolchain is relevant to the Skill's declared function, but immediate execution of mutable, unverified network content exceeds the minimum safe mechanism needed to perform that installation.

Attack Path

1. A user or agent follows the documented project-scaffolding instructions.
2. curl requests the installer from https://sh.starkup.sh.
3. The domain, hosting infrastructure, publication process, or delivered installer is compromised or otherwise supplies malicious content.
4. The shell pipeline passes that content directly to sh without an integrity or authenticity check.
5. The malicious commands execute with the privileges and environment access of the invoking user.

Impact Assessment

A malicious installer could perform arbitrary actions available to the invoking account. Depending on that account's privileges and local environment, this could include reading or modifying source files, stealing credentials or wallet private keys, altering shell configuration, installing additional payloads, or ...[truncated 306 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not pipe network responses directly into a shell.
2. Use an official package manager or another installation mechanism that verifies package authenticity and integrity where available.
3. Pin the installer or release artifact to an explicit, reviewed version rather than a mutable endpoint.
4. Download the artifact as a separate step and verify a hardcoded cryptographic checksum or trusted publisher signature before execution.
5. Allow users to inspect the downloaded script before running it.
6. Execute the installer with the least-privileged account necessary and document its expected files, permissions, and side effects.
7. Fail closed if verification fails; do not fall back to executing an unverified download.

A safer conceptual flow is:

bash

curl --proto '=https' --tlsv1.2 -fSLo starkup.sh \
  https://example.invalid/releases/<PINNED_VERSION>/starkup.sh
echo '<TRUSTED_SHA256>  starkup.sh' | sha256sum --check -
sh starkup.sh

The release URL and checksum must come from an authenticated, trusted publisher source.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to fetch a remote script and immediately execute it via the shell, which bypasses meaningful inspection, pinning, and integrity verification. If the remote host, DNS/TLS path, or published installer is compromised, users could execute arbitrary code on their machine during project setup.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install toolchain and create a project:

bash

curl --proto '=https' --tlsv1.2 -sSf https://sh.starkup.sh | sh
scarb new my_project --test-runner=starknet-foundry

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh pattern is the dangerous execution primitive that turns a network retrieval into immediate code execution. In this context, the skill is specifically for developer environment setup, so users are likely to copy-paste the command verbatim, increasing the likelihood of silent compromise if the fetched content is altered.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install toolchain and create a project:

bash

curl --proto '=https' --tlsv1.2 -sSf https://sh.starkup.sh | sh
scarb new my_project --test-runner=starknet-foundry