CLI-Hub Tools

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:25 AM UTC
• Version: 1.0.0

Overview

This is a Chinese CLI reference skill that lists installation and launch commands for a third-party CLI hub; it has supply-chain and user-caution risks but no hidden execution or deceptive behavior in the artifact.

Install only if you intentionally want CLI-Hub to manage third-party CLI tools. Use a virtual environment or other containment, review the upstream package and each tool before installing or launching it, and be especially careful with tools that can control browsers, cloud accounts, processes, or local data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: Unverified and unpinned dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

pip install cli-anything-hub

Technical Analysis

The documented installation command retrieves the latest resolver-selected release of cli-anything-hub and its transitive dependencies. It does not specify an audited version, require package hashes, identify a verified source, or provide signature-verification instructions.

Because the package version is not fixed, the effective code installed by this instruction can change after the Skill has been reviewed. A compromised publisher account, malicious replacement release, dependency-confusion condition, or compromised transitive dependency could therefore introduce attacker-controlled code. The installed hub also manages other command-line components, further expanding the downstream supply-chain exposure.

Attack Path

1. An attacker compromises the package, one of its transitive dependencies, or an applicable package-distribution channel.
2. The attacker publishes a malicious release that satisfies the unrestricted installation request.
3. A user follows the documented pip install cli-anything-hub instruction.
4. The package resolver downloads and installs the attacker-controlled release.
5. Malicious package installation hooks or subsequently invoked package functionality execute with the privileges of the user running pip.
6. If the command is run by an administrator or against a system-wide Python environment, the resulting impact can extend to system-level files and all users of that environment.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Potential consequences include access to that user's files, environment variables, credentials available to local processes, and resources reachable ...[truncated 322 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version rather than installing an unrestricted latest release.
• Generate and verify cryptographic hashes for the package and all transitive dependencies, such as through a locked requirements file used with pip --require-hashes.
• Document the canonical package index and upstream source repository, and reject unexpected alternative indexes.
• Prefer signed releases or attestations when the upstream project provides them, and verify signatures before installation.
• Install inside an isolated virtual environment or container using a non-privileged account.
• Audit all transitive dependencies and the hub-managed CLI sources before installation or execution.
• Require explicit user confirmation before installing, updating, or launching downstream tools.
• Use an internally reviewed package mirror or allowlist in managed environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill prominently instructs users to install, update, uninstall, and launch external CLIs, including browser automation, cloud, workflow, and local AI tools, but provides no warning that these actions can modify the host system, access accounts, consume resources, or affect user data. In this context, omission of safety guidance is risky because the skill acts as a launcher/catalog for potentially powerful third-party tools, increasing the chance of unsafe execution by users or downstream agents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description and usage guidance are entirely in Chinese, and the file does not offer an alternative language or indicate that the skill is intentionally limited to Chinese-speaking users. This creates a language/locale policy concern because the skill effectively forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.