Shuttle AI Chatbot

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:46 AM UTC
• Version: 2.0.1

Overview

This skill is a disclosed Shuttle AI query tool, but crafted queries or settings could make it run unintended local shell commands.

Install only if you trust the Shuttle AI endpoint and will avoid sensitive prompts unless that backend is approved for them. Do not pass untrusted query files, query text, --url values, or --lang values to this version; the CLI should be fixed to use fetch/http.request or execFile/spawn with argument arrays plus URL and language validation before routine use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:47

Finding

OS Command Injection Through User-Controlled CLI Inputs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly encourages direct calls to a local AI service and provides a default internal-looking URL, but it does not warn users that their prompts and batch query contents will be transmitted to that service. This can lead to inadvertent disclosure of sensitive product, customer, or internal business information, especially because the batch mode makes bulk transmission easy and the target is a non-loopback network host rather than a clearly isolated local process.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly sends user queries and a session identifier to an HTTP service, but the documentation does not clearly warn users that their inputs and tracking metadata are transmitted and may be logged by the backend. Because the endpoint uses plain HTTP and a fixed local-network address by default, sensitive queries could be exposed to interception or unintended retention on the network or service side.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation states that URL validation only allows localhost or private IPs, but the same skill usage examples and parameter description allow user-supplied service URLs without clearly enforcing that restriction. This inconsistency can mislead users and integrators into assuming outbound requests are constrained when they may not be, increasing the risk of SSRF-like access to unintended internal or external services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module comment says it "directly" calls the backend API and removed browser automation for stability, which implies an in-process API integration. In reality, the code invokes curl through child_process.exec, so it still relies on external process execution rather than a direct HTTP client call.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The skill transmits user queries to an external or separate backend service, which is a real data exposure surface because prompts and returned content leave the local process boundary. This is more significant here because the default endpoint is a hardcoded private-network host, so users may unknowingly send internal or sensitive content to a service they did not explicitly configure.

Content

Scanner excerpt · index.js (reported line 9)May include surrounding context.

js

* 
 * 优化：
 * - 移除浏览器自动化（不稳定）
 * 直接使用 curl 调用本地 AI 服务
 * - session_id 格式：shuttle-cli-YYYYMMDD
 * - 更快速、更稳定
 */

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill sends user-supplied queries to a backend service over the network without an explicit warning or consent prompt, which can expose sensitive prompts, secrets, or proprietary data to another system. In a CLI skill context, users may assume local processing unless clearly told otherwise, making inadvertent data disclosure more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The request payload hard-codes the default language to 'zh' when no language is specified, which forces a specific locale by default. While a --lang option exists elsewhere, users who do not discover or set it will still be subject to a non-neutral language choice without explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest sets the lang option default to zh, which imposes a specific language by default rather than requiring the user to choose. The policy allows language constraints only when the user is given a choice or the constraint is clearly documented and justified; here a choice exists, but the default still forces Chinese unless the user overrides it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The parameter table specifies --lang supports zh or en, but sets the default to zh. This imposes a specific language by default rather than prompting for or preserving user preference, which can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The parameter table sets --lang default to zh, which forces a specific response language unless the user overrides it. Although English is supported, the default behavior imposes a locale choice rather than prompting or adapting based on user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package description includes Chinese-language instructions and behavior notes, but there is no indication that language is configurable or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy expectations when a skill implicitly enforces a language without user opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

"author": "Shuttle AI",
  "license": "MIT",
  "dependencies": {
    "commander": "^14.0.3"
  }
}