Windy Access

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 0.3.1

Overview

The skill is mostly coherent with its Windy onboarding purpose, but it asks agents to install mutable remote code and then persist sensitive credentials into local agent configuration.

Review before installing. Avoid the curl-to-shell path, prefer a pinned and verifiable CLI package, and only proceed if you trust Windy and the publisher to handle email, chat, LLM, and identity credentials. Confirm which runtimes will be modified and know how to disconnect and revoke credentials afterward.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: .
• Finding: Mutable Remote Installer Executed Directly by a Shell## Vulnerability Details **File Location**: `SKILL.md:89` and `README.md:131` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Complete vulnerable snippets:** `SKILL.md:89`: ```bash curl -fsSL https://get.windyconnect.com | sh ``` `README.md:131`: ```bash curl get.windyconnect.com | sh ``` ### Technical Analysis Both instructions download content from `get.windyconnect.com` and pass it directly to `sh`. The downloaded script is not included in the audited project, pinned to an immutable version, checked against a cryptographic digest, or verified using a trusted digital signature. Consequently, the effective code executed by the Skill can change after this package has been reviewed. HTTPS only protects the connection in transit. It does not protect users if the domain, DNS, hosting account, CDN, deployment pipeline, or signing authority is compromised, nor does it prevent the operator from replacing the installer. The README variant also omits `curl -f`, so an unexpected HTTP response could still be passed to the shell. The external installer is expected to install a CLI that later handles email passwords, API keys, Matrix tokens, and identity credentials. No installer or CLI source is present in this project, so its actual behavior and security controls cannot be verified. ### Attack Path 1. The user invokes the Skill on a system where `windy` is not installed. 2. The agent follows the installation instructions and runs the `curl | sh` pipeline. 3. An attacker compromises or otherwise gains control over the response returned by `get.windyconnect.com`. 4. The server returns a modified shell script containing attacker-selected commands. 5. `sh` executes those commands immediately without review or integrity verification. 6. The payload operates with the privileges of the user running the agent and may subsequently install additional components or access user-readable ...[truncated 699 chars]
• Remediation: ## Remediation Suggestions 1. Remove all `curl | sh` installation instructions. 2. Publish the installer and CLI source in an auditable repository. 3. Distribute an immutable, versioned release artifact. 4. Separate downloading from execution so users can inspect the installer: ```bash curl -fL -o windy-connect-installer.sh https://example.invalid/releases/v0.2.0/install.sh ``` 5. Publish a SHA-256 digest through a separately protected release channel and verify it before execution: ```bash echo "EXPECTED_SHA256 windy-connect-installer.sh" | sha256sum --check - ``` 6. Sign release artifacts and require signature verification against a documented, pinned public key. 7. Avoid automatically executing the downloaded artifact; require an explicit user decision after verification. 8. Ensure the installer operates without elevated privileges and clearly enumerates every file and command it will modify. 9. Prefer a trusted package manager with version pinning and provenance attestations over a custom network-delivered shell installer.

T08 · Insecure Dependencies

Error

• Location: .
• Finding: Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md:91` and `README.md:130` **Vulnerability Type**: Insecure dependency installation **Risk Level**: High **Complete vulnerable snippet:** ```bash pipx install windy-connect ``` The same unpinned installation command is presented in both `SKILL.md` and `README.md`. ### Technical Analysis The installation command does not specify an audited package version, artifact hash, dependency lockfile, or package provenance requirement. It therefore resolves the latest available `windy-connect` package and its allowed transitive dependencies at installation time. The reviewed project contains only documentation and does not include the package source or dependency manifest. As a result, the code installed and executed by this instruction is not determined by the reviewed Skill version. A compromised publisher account, malicious future release, package-index compromise, or compromised transitive dependency could introduce arbitrary code without any modification to this repository. Python package installation may execute build backends or other package-controlled installation logic. The installed CLI will also execute later with access to the invoking user's files and is explicitly expected to handle sensitive credentials. ### Attack Path 1. An attacker compromises the `windy-connect` publisher account, release process, or one of its unpinned transitive dependencies. 2. The attacker publishes a malicious version that still satisfies the unversioned installation request. 3. A user or agent follows the Skill instructions and runs `pipx install windy-connect`. 4. The package index resolves the malicious current release or dependency. 5. Package-controlled code executes during installation or when the `windy` command is invoked. 6. The malicious code accesses user-readable files, modifies runtime configuration, or captures credentials handled during the pairing process. ### Impact ...[truncated 597 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI to a specific audited version: ```bash pipx install "windy-connect==0.2.0" ``` 2. Publish the exact source corresponding to every release and provide verifiable source-to-artifact provenance. 3. Lock all transitive dependencies to reviewed versions and hashes. 4. Use hash-verified installation artifacts. If `pipx` cannot enforce the required hash policy directly, install from a preverified local wheel or use a fully locked requirements workflow. 5. Publish signed wheels and verify signatures or trusted provenance attestations before installation. 6. Use isolated, reproducible builds and monitor publisher accounts and dependencies for compromise. 7. Document the expected package owner, package index, version, digest, and signing identity so dependency-confusion or source-substitution attempts can be detected. 8. Avoid automatic upgrades to unaudited releases; upgrades should require an explicit version change and security review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

- The CLI itself: `pipx install windy-connect` (PyPI publishing flow per
  [docs/pypi-setup.md](../../docs/pypi-setup.md)) or
  `curl get.windyconnect.com | sh`
- Bundle spec: [docs/bundle-spec-v1.md](../../docs/bundle-spec-v1.md)
- ADR-052 (two-tier access): [docs/adr/](../../docs/adr/)

• Confidence: 99% confidence
• Finding: `curl get.windyconnect.com | sh` is a direct remote-code-execution pattern: it fetches a script from the network and immediately executes it in the user's shell. This creates a high-risk supply-chain vector because any compromise of DNS, TLS termination, the web server, CDN, or the script publisher can turn the install command into arbitrary code execution.

External Script Fetching

High

• Category: Supply Chain

Content

If `windy` is not on PATH:

```bash
curl -fsSL https://get.windyconnect.com | sh
# or, manually:
pipx install windy-connect
```

• Confidence: 99% confidence
• Finding: Using 'curl -fsSL https://get.windyconnect.com | sh' downloads and immediately executes a remote script with the user's shell, giving the remote endpoint complete code execution authority. In the context of an agent skill that can be triggered by user phrasing and that later handles credentials, this is especially dangerous because compromise of the installer endpoint, CDN, DNS, or TLS trust chain can lead to arbitrary system compromise before any pairing occurs.

Chaining Abuse

High

• Category: Tool Misuse

Content

If `windy` is not on PATH:

```bash
curl -fsSL https://get.windyconnect.com | sh
# or, manually:
pipx install windy-connect
```

• Confidence: 98% confidence
• Finding: The explicit command chaining into 'sh' is a classic unsafe execution pattern that bypasses meaningful review of fetched content and encourages immediate execution of untrusted network data. Here it materially increases risk because the skill is about provisioning credentials and modifying agent configuration, so a malicious or altered installer could harvest existing secrets, persist backdoors, or silently reconfigure runtimes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README recommends a `curl ... | sh` install path with no integrity verification, pinning, signature check, or warning about the risks of executing a remote script directly in a shell. If the hosting domain, network path, or served script is compromised, users could execute arbitrary attacker-controlled code on their machine during installation.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough to match common requests like giving an agent email or free LLM access, which could cause the skill to activate in situations where the user did not specifically intend to install and pair a third-party credentialing system. In this skill, accidental activation is more dangerous because execution leads to software installation, browser-based OAuth/device pairing, and writing credentials into multiple agent/runtime config locations.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The 'When to use this skill' section provides broad activation cues without requiring explicit user consent for installing software, opening a browser, or wiring credentials into local runtimes. Because this skill performs high-impact onboarding actions and persists secrets, ambiguous invocation criteria increase the risk of unintended credential provisioning and environment modification.

External Transmission

Medium

• Category: Data Exfiltration

Content

This:

1. Opens `https://api.windyconnect.com/pair` in the user's default browser with a one-time user code.
2. Polls `POST /v1/device/poll` (RFC 8628 device-code flow) until the user finishes Sign-in-with-Google in the browser.
3. Receives the bundle and writes credentials into the locations in the per-runtime table above. **Auto-detects the host runtime.**

• Confidence: 84% confidence
• Finding: The skill transmits the user into an external pairing flow and polls a remote API to obtain a credentials bundle, resulting in sensitive identity and access material being provisioned from a third-party service. External transmission is expected for this functionality, but it remains security-relevant because the bundle contains secrets for mail, chat, identity, and model access and the skill auto-detects local runtimes to place them.

Static analysis

No suspicious patterns detected.