ClawHub
Back to skill

Security audit

Setup Stellar Contracts

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Stellar setup guide, but it tells users or agents to run unverified remote installer scripts directly in a shell.

Install only if you are comfortable with the setup guide's remote installer commands. Prefer downloading installers first, inspecting them, using pinned releases or package managers, and verifying checksums or signatures before running anything in your shell.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unverified Remote Rust Installer Executed Directly by Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Technical Analysis

The installation command retrieves a script from an external URL and passes the response directly to sh. The downloaded content is neither pinned to an immutable version nor verified using a cryptographic signature or expected digest before execution.

The HTTPS and TLS restrictions protect the network connection, but they do not guarantee that the mutable content hosted at the URL remains safe. A compromise of the upstream infrastructure, distribution service, publishing credentials, DNS or certificate trust chain could cause different commands to be delivered after the Skill has been reviewed.

Installing Rust is consistent with the Skill's declared Stellar development setup functionality. However, executing mutable network content without independent verification exceeds the minimum risk necessary to perform that installation.

Attack Path

  1. An attacker compromises the upstream installer, its publishing process, hosting infrastructure, or another relevant delivery component.
  2. The attacker modifies the response from https://sh.rustup.rs to include malicious shell commands.
  3. A user or agent follows the installation instructions in SKILL.md.
  4. curl retrieves the altered script.
  5. The shell immediately executes the response without providing an opportunity for integrity verification or review.
  6. The malicious commands run with the permissions of the account executing the Skill.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's privileges. The resulting access could include reading or modifying user-accessible files, stealing development credentials and source code, alteri ...[truncated 379 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell.
  • Prefer an authenticated operating-system package manager or another installation mechanism that verifies publisher metadata.
  • If the upstream installer must be used, download it to a local file first.
  • Pin the installer to an immutable, reviewed release where the publisher supports doing so.
  • Verify a publisher-provided cryptographic signature or a securely obtained, pinned SHA-256 digest before execution.
  • Allow the downloaded script to be inspected before running it.
  • Execute the installer as an unprivileged user and avoid unnecessary sudo or root execution.
  • Document the expected files and environment changes so users can assess the installation scope.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:23
Finding

Mutable Stellar CLI Installer from Main Branch Executed Directly by Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 23
Vulnerability Type: Remote payload retrieval and execution through an unpinned supply-chain source
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh

Technical Analysis

This command downloads install.sh from the mutable main branch of the Stellar CLI GitHub repository and immediately executes the response with sh. It does not pin the installer to a release version or immutable commit and does not verify a signature or checksum.

The repository appears related to the declared Stellar setup functionality rather than being an unrelated personal hosting location. Nevertheless, a mutable branch can change after the Skill is audited. GitHub transport security does not protect against malicious changes made through a compromised maintainer account, repository, automation token, or upstream publishing process.

Installing Stellar CLI is necessary for the declared workflow, but immediate execution of unverified content from a mutable branch is not required. A pinned and independently verified release can provide the same functionality with less supply-chain exposure.

Attack Path

  1. An attacker compromises the Stellar CLI repository, a maintainer account, a publishing token, or the relevant upstream workflow.
  2. The attacker modifies install.sh on the main branch or otherwise causes malicious content to be served from the referenced URL.
  3. A user or agent runs the command documented in SKILL.md.
  4. curl follows redirects and retrieves the attacker-controlled response.
  5. The response is passed directly to sh without version or integrity validation.
  6. The attacker's commands execute with the invoking user's permissions and may install a trojanized CLI or additional payloads.

Impact Assessment

Exploitation enables arbitrary command execution in the ...[truncated 604 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the mutable main reference with a specific, reviewed release version or immutable commit.
  • Prefer official signed release artifacts or a package manager that verifies repository and package metadata.
  • Download the installer or binary separately rather than piping it directly to sh.
  • Verify a publisher-provided signature and checksum against values obtained through a trusted channel.
  • Fail closed if verification is unavailable or does not match.
  • Run the installation with ordinary user privileges and avoid requesting administrative access unless a documented installation step strictly requires it.
  • Pin the installed Stellar CLI version and document a controlled update process.
  • Where practical, inspect the installer and identify all downloaded secondary artifacts, ensuring those artifacts are also version-pinned and integrity-verified.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | sh pipeline turns network content into immediate shell execution, which is a classic command-chaining anti-pattern. In a setup skill, users are likely to paste commands blindly, making this context more dangerous because it normalizes unsafe execution of unverified installer code.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install the Rust toolchain (v1.84.0+) and the Soroban WASM target:

bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
rustup target add wasm32v1-none

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Piping a script from github.com/.../raw/main/install.sh into sh combines two dangerous properties: immediate shell execution and an unpinned mutable source. This significantly raises the risk of supply-chain compromise and arbitrary code execution on developer workstations.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Install the Stellar CLI:

bash
curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh

Create a new Soroban project:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs users to execute remotely fetched install scripts directly with sh and provides no warning or verification step. This creates a supply-chain risk: if the upstream script, hosting account, or transport path is compromised, users may run arbitrary code on their machines during environment setup.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

This command fetches an external script from sh.rustup.rs and immediately executes it. Even though Rustup is legitimate, direct execution of network-retrieved code removes the opportunity for inspection or integrity validation and can lead to arbitrary command execution if the source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install the Rust toolchain (v1.84.0+) and the Soroban WASM target:

bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
rustup target add wasm32v1-none

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

This command downloads and executes a shell script directly from a GitHub raw/main URL, which is especially risky because it tracks a moving branch head rather than a pinned immutable release artifact. If the repository, branch, or delivery path is compromised, the skill causes immediate arbitrary code execution on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Install the Stellar CLI:

bash
curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh

Create a new Soroban project: