watch-cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 1.0.2

Overview

The skill is mostly purpose-aligned, but its fallback installer runs a downloaded shell script before local verification, so users should review the install path before trusting it.

Prefer the Homebrew install path or independently inspect and verify the release installer before using the shell command. Install only if you are comfortable with video URLs being fetched, audio being sent to Kyma API unless local transcription is installed, and video-derived files being cached locally. Do not enable browser-cookie access unless the specific video requires it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

yaml

command: "curl -fsSL https://github.com/sonpiaz/watch-cli/releases/download/v0.3.4/install.sh | WATCH_CLI_VERSION=0.3.4 bash"

Technical Analysis

The installation command retrieves a shell script from an external GitHub release and immediately pipes it into bash. Although the URL contains a fixed release version, the downloaded install.sh is not authenticated against a digest stored in the audited project before execution.

SKILL.md states that the installer verifies the SHA-256 digest of a subsequently downloaded tarball. That claim cannot be validated from this project because neither the installer nor its expected digest is included. Moreover, tarball verification by the downloaded script does not establish the integrity of the script itself: the installer begins executing before any local trust decision can be made.

This behavior exceeds the minimum privilege needed to acquire an executable because the artifact could instead be downloaded as data, verified using a digest committed in the reviewed project, and only then executed or installed.

Attack Path

1. The required watch executable is absent, causing the Skill host or user to select the shell installation method.
2. The host sends an HTTPS request to the external GitHub release URL.
3. The response body is streamed directly into bash without first being saved, inspected, or checked against a locally trusted digest.
4. If the release account, artifact, or other relevant supply-chain component has been compromised, attacker-controlled shell commands execute immediately.
5. Those commands run with the privileges of the user or agent host performing installation and can access resources available to that account.

Impact Assessment

A compromised installer can execute arbitrary commands with the i ...[truncated 477 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash installation pattern.
2. Download the installer or final binary to a local file without executing it.
3. Commit the expected SHA-256 digest to the reviewed project or another independently trusted, immutable manifest.
4. Verify the downloaded artifact with a local verification command before any execution occurs, and fail closed on mismatch.
5. Execute only the verified artifact, using the least-privileged account needed for installation.
6. Prefer a trusted package manager with immutable, reviewed artifacts and enforced digest validation.
7. If an installer remains necessary, vendor it into the audited package so reviewers can inspect its complete behavior.
8. Consider signature verification backed by a trusted public key stored independently from the release artifact; a checksum published only alongside the downloadable artifact does not adequately protect against release-account compromise.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation guidance is intentionally broad: it says to use the skill whenever a user provides a video URL and wants almost anything done with its contents. In an agent setting, that can cause over-invocation on common requests, unnecessarily sending third-party URLs and media-derived data through external tooling and potentially to an external transcription service, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.