ClawHub
Back to skill

Security audit

Tap Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill advertises a trust/reputation agent layer but its only install path runs a mutable remote shell script directly, so users cannot verify what will execute.

Treat this as a Review item before installing. Only run the installer if you independently trust the publisher and have inspected the downloaded script first; prefer a pinned release with checksums or signatures and clear documentation of installed files, persistence, network access, and uninstall steps.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unaudited Remote Installer Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
curl -sSL https://trust-audit-framework.vercel.app/api/agent/install | bash

Technical Analysis

The documented installation command downloads shell content from a live API endpoint and immediately executes it with bash. The project contains no local implementation, pinned release, checksum, cryptographic signature, or inspectable installer. The effective payload can therefore change after the Skill has been reviewed.

HTTPS protects data in transit but does not guarantee that the server will always return the audited payload. Compromise of the remote service, its deployment account, DNS or hosting infrastructure—or intentional modification by its operator—could cause arbitrary shell commands to be returned and executed.

This installation mechanism is not necessary for the declared reputation and attestation functionality. It grants mutable remote content all permissions held by the invoking user and therefore does not satisfy least-privilege principles.

Attack Path

  1. A user or autonomous agent follows the installation command in SKILL.md.
  2. The external endpoint is compromised or intentionally changed to return malicious shell code.
  3. curl retrieves the malicious response without saving it for inspection.
  4. The pipe sends the response directly to bash.
  5. Bash executes the payload with the invoking user's permissions.
  6. The payload can access user-readable data, modify user-writable files, execute additional programs, or establish persistence where existing permissions allow it.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. This may expose credentials, configuration files, source code, agent state, and other user-accessible data. It may also ...[truncated 609 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the curl | bash pipeline with a versioned installer artifact hosted in a verifiable release repository.
  2. Pin the installer to an immutable version or commit rather than a mutable API endpoint.
  3. Publish the complete installer source so users and auditors can inspect its behavior.
  4. Provide a documented SHA-256 digest and verify it before execution.
  5. Cryptographically sign release artifacts and document signature verification using a pinned, independently distributed public key.
  6. Separate download, verification, inspection, and execution into distinct commands.
  7. Avoid requiring administrator privileges; explicitly document the files, network access, and permissions needed.
  8. Ensure installation is confined to a dedicated directory and does not create startup services, scheduled tasks, or other persistence without explicit informed consent.
  9. Vendor the implementation in the Skill package where practical so its behavior can be reviewed statically.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This line explicitly retrieves executable content from an external URL and runs it locally. In the context of a trust/audit skill, this is more dangerous because users may lower their guard due to the branding around verification and reputation, making social-engineering-assisted remote code execution more likely.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install

bash
curl -sSL https://trust-audit-framework.vercel.app/api/agent/install | bash

Features

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The pipe into bash is the core dangerous action because it turns downloaded text into immediate shell execution. This prevents meaningful review, amplifies the blast radius of any compromise, and can execute attacker-controlled shell commands with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install

bash
curl -sSL https://trust-audit-framework.vercel.app/api/agent/install | bash

Features

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The install instructions present a normal setup step, but the command fetches a script from the network and immediately executes it. This gives the remote server full control over code run on the user's system at install time, and any compromise of the endpoint, hosting, DNS, or supply chain can lead to arbitrary command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Piping a remote install script straight into bash executes unreviewed code without giving users a chance to inspect it or verify authenticity. The absence of any warning normalizes unsafe behavior and increases the chance of silent compromise if the remote content is malicious or later altered.

Content

No source excerpt is available for this finding.