Security audit

using-data-cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for operating a local data CLI, but it asks users to install mutable third-party code and includes persistent scheduler instructions that deserve review before installation.

Install only if you trust the GitHub repository and package source. Prefer pinning a known commit/version, reviewing dependency setup, and avoiding cron/launchd/systemd scheduling unless you explicitly want recurring background syncs and know how to disable them. Confirm any install or uninstall interactions against data_hub before allowing the agent to run them.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:138
Finding: Persistent Execution Through Cron, launchd, or systemd
Content: View full analysis
> /abs/path/to/agent-data-cli/update.log 2>&1 ``` If you need tighter OS integration, the same pattern can also be implemented with `launchd` or `systemd`. ``` ### Technical Analysis The Skill instructs the Agent to configure an operating-system scheduler and explicitly recommends `cron`, `launchd`, or `systemd`. Unlike a command executed only during the current Skill invocation, a scheduled task survives the Agent session and repeatedly runs the external `agent-data-cli` installation. The scheduled command performs network-capable content synchronization and writes output to a persistent log. Its effective behavior depends on the subsequently loaded CLI, dependencies, source workspace, and configuration. If any of those components are compromised or modified after the initial setup, the scheduler will continue executing the changed code without requiring another Agent interaction. The scheduled process runs with the permissions of the account or service under which the scheduler entry is installed. The documented command does not itself demonstrate privilege escalation, but a system-level service created with elevated privileges could increase the resulting scope. ### Attack Path 1. A user asks the Agent to configure periodic synchronization. 2. The Skill causes the external CLI and its dependencies to be installed. 3. A cron entry, launchd job, or systemd unit is configured to invoke the CLI periodically. 4. The scheduled entry remains active after the current Agent session ends. 5. An ...[truncated 973 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:42
Finding: Execution of Unpinned Third-Party Repository and Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill instructs users to install from a remote source via npx skills add ... without pinning a specific version or commit. That makes execution dependent on whatever package version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill documents an explicit uninstall command for remote interaction against data_hub without warning that it removes installed sources and may disrupt configured workflows. In an operational skill that tells the agent to execute CLI flows directly, this increases the chance of unintended destructive actions if user intent is ambiguous or the command is suggested/executed without a confirmation step.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.