T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:111- Finding
Privileged Execution of Mutable Remote Installation Scripts
- Content
View full analysis
- Remediation
View remediation
Security audit
Speedtest
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for speed testing and sharing results, but its install instructions tell users to run a mutable internet-fetched script as root.
Review carefully before installing. Do not run the documented curl | sudo bash commands; use a safer vendor or package-manager installation path with verification. Treat speedtest results as potentially privacy-sensitive, since they can include network and location-adjacent metadata, and only publish to Moltbook or Twitter after reviewing the generated post and using a narrowly scoped, revocable token.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/speedtest-social.sh:112- Finding
Moltbook Bearer Token Exposed Through Process Arguments
- Content
View full analysis
&2 else API_KEY=$(grep -o '"api_key":"[^"]*"' "${HOME}/.config/moltbook/credentials.json" | cut -d'"' -f4) # Post to Moltbook RESPONSE=$(curl -s -X POST https://www.moltbook.com/api/v1/posts \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "{\"submolt\": \"general\", \"title\": \"📊 SpeedTest Results\", \"content\": $(echo "$POST_TEXT" | jq -Rs .)}") ``` ### Technical Analysis Access to the Moltbook credential is directly related to the declared, user-selected social-posting feature and is therefore functionally justified. The script only reads the expected credential path when Moltbook publishing is selected. No evidence shows unrelated credential enumeration or transmission to an undeclared endpoint. However, the API key is interpolated into the `curl` argument vector as part of the `Authorization` header. While the request is running, processes with sufficient local process-inspection access may be able to observe the complete command line and recover the bearer token. Applicable access depends on operating-system process isolation, `/proc` configuration, and tracing restrictions. The credential is also parsed using a whitespace-sensitive `grep` expression rather than a JSON parser. Valid JSON such as `"api_key": "value"` would not match, and malformed or duplicate fields are not handled robustly. This is primarily a reliability concern but contributes to unsafe secret handling. ### Attack Path 1. The user selects Moltbook publishing or invokes the script with `--post-to-moltbook`. 2. The script reads the API key from ...[truncated 918 chars]- Remediation
View remediation
0)' \ "${HOME}/.config/moltbook/credentials.json") ``` - Verify that the credential file is owned by the expected user and is not group- or world-readable. - Use a narrowly scoped and revocable Moltbook token where the service supports it. - Avoid logging the authorization header, shell tracing, or responses that may reflect secret material. - Preserve the existing explicit user confirmation before publishing and clearly document the credential access and destination. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented purpose focuses on speed testing, but the skill also includes behavior for publishing to external social platforms, using stored credentials, and invoking additional tooling. That gap is dangerous because users and policy systems may approve a benign diagnostic skill while it also performs outbound posting and credential-dependent actions.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The installation instructions fetch an external script over the network and execute it, which is a classic supply-chain risk. Because the fetched script configures package sources and is later executed with elevated privileges, compromise of that script or endpoint can lead to arbitrary code execution and persistent system modification.
- Content
Linux (Debian/Ubuntu):
bash sudo apt-get install curl curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The pipe into sudo bash creates a dangerous command chain where untrusted remote content is immediately executed as root without inspection. This pattern eliminates opportunities for validation and magnifies any compromise into full privileged code execution.
- Content
Linux (Debian/Ubuntu):
bash sudo apt-get install curl curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
Fetching an external script from the internet and immediately executing it is a classic high-risk supply-chain pattern. The skill context makes this more dangerous because users may treat reference documentation as trusted operational guidance and run the command without reviewing the script contents.
- Content
Ubuntu/Debian:
bash curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The shell pipe chains network retrieval directly into privileged execution, removing any opportunity for inspection or validation between fetch and run. This significantly amplifies the danger of the command and turns any upstream compromise into immediate root code execution.
- Content
Ubuntu/Debian:
bash curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
This is the same unsafe remote-script execution pattern for RPM-based systems, creating a supply-chain compromise path with root-level impact. Because the file is framed as an official reference, readers are more likely to copy-paste it directly, reducing scrutiny and increasing exploitability.
- Content
Fedora/CentOS/RedHat:
bash curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.rpm.sh | sudo bash sudo yum install speedtest
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
This command uses a risky fetch-to-pipe-to-root chain, which is a well-known abuse pattern for malware delivery and supply-chain attacks. The danger is elevated by the skill's practical how-to context, where users are likely to execute the exact command verbatim.
- Content
Fedora/CentOS/RedHat:
bash curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.rpm.sh | sudo bash sudo yum install speedtest
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh echo "Posting to Moltbook..." >&2 # Check for credentials if [ ! -f "${HOME}/.config/moltbook/credentials.json" ]; then echo "Error: Moltbook credentials not found at ~/.config/moltbook/credentials.json" >&2 else API_KEY=$(grep -o '"api_key":"[^"]*"' "${HOME}/.config/moltbook/credentials.json" | cut -d'"' -f4)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh echo "Posting to Moltbook..." >&2 # Check for credentials if [ ! -f "${HOME}/.config/moltbook/credentials.json" ]; then echo "Error: Moltbook credentials not found at ~/.config/moltbook/credentials.json" >&2 else API_KEY=$(grep -o '"api_key":"[^"]*"' "${HOME}/.config/moltbook/credentials.json" | cut -d'"' -f4)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The script extracts an API key from a local credentials file for use in an outbound request. While this is expected functionality for posting, it is still sensitive credential access, and combined with automatic social-posting behavior it increases the blast radius if the script is modified, abused, or logs/debug output expose the key.
- Content
sh if [ ! -f "${HOME}/.config/moltbook/credentials.json" ]; then echo "Error: Moltbook credentials not found at ~/.config/moltbook/credentials.json" >&2 else API_KEY=$(grep -o '"api_key":"[^"]*"' "${HOME}/.config/moltbook/credentials.json" | cut -d'"' -f4) # Post to Moltbook RESPONSE=$(curl -s -X POST https://www.moltbook.com/api/v1/posts \
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill clearly instructs use of shell commands and local scripts, but it does not declare any explicit tool scope or permissions. That omission weakens reviewability and can cause an agent framework to invoke shell-capable behavior without clear operator awareness or policy boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation phrases are broad and overlap with common user requests, increasing the chance the skill is auto-selected in contexts where the user did not intend shell execution, network testing, history writes, or social-post workflows. In an agent environment, overbroad triggering expands the attack surface and can lead to unintended privileged actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The social posting section encourages publishing infrastructure and location-adjacent network information without a clear warning about privacy, metadata exposure, or account use. Publicly sharing speed, latency, and server/location details can reveal operational patterns or environment characteristics that some users would not want disclosed.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Debian/Ubuntu):
bash sudo apt-get install curl curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Debian/Ubuntu):
bash sudo apt-get install curl curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Debian/Ubuntu):
bash sudo apt-get install curl curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Debian/Ubuntu):
bash sudo apt-get install curl curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This command executes remotely fetched content through sudo bash, combining root privileges with unverified network-delivered script execution. If the remote repository, transport path, or host is compromised, the system can be fully compromised with root-level impact.
- Content
Linux (Debian/Ubuntu):
bash sudo apt-get install curl curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The reference explicitly shows that Speedtest CLI outputs and transmits identifying network metadata such as internal IP, external IP, MAC address, interface name, ISP, and server details, but the document does not warn users about this privacy exposure. In a skill meant to run tests and format/share results socially, omission of these warnings increases the chance that sensitive network information is collected or disclosed without informed consent.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This command executes a remotely fetched shell script with root privileges via
curl ... | sudo bash, which gives an external endpoint immediate privileged code execution on the user's machine. Even if this mirrors vendor installation guidance, it is a dangerous pattern because compromise of the remote host, TLS interception, or script changes could lead to full system compromise.- Content
Ubuntu/Debian:
bash curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh | sudo bash sudo apt-get install speedtest
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This line again combines remote content retrieval with privileged execution, allowing a network-fetched script to run as root. In documentation for an agent skill, reproducing this pattern normalizes unsafe installation behavior and could lead to privileged compromise if the external script is malicious or tampered with.
- Content
Fedora/CentOS/RedHat:
bash curl -s https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.rpm.sh | sudo bash sudo yum install speedtest
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script invokes the external
speedtestCLI, which necessarily makes network requests to remote test servers, and then appends the resulting metadata to a persistent file under the user's home directory. While it prints that it is running a speed test and saving history, there is no explicit user-facing warning that network/server information will be transmitted and retained locally.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script automatically writes detailed speedtest results, including timestamp and server/location metadata, to a persistent file under the user's home directory without explicit notice or consent. Persistent collection of network telemetry can expose location-adjacent information and usage history to other local processes or users, especially on shared systems.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The script creates and appends to a persistent history file, causing session data to survive beyond the immediate command execution. That persistence can accumulate sensitive behavioral and network metadata over time, creating unnecessary privacy and forensic exposure.
- Content
sh # Save to history HISTORY_FILE="${HOME}/.openclaw/data/speedtest-history.jsonl" mkdir -p "$(dirname "$HISTORY_FILE")" TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ") echo "{\"timestamp\":\"$TIMESTAMP\",\"download\":$DOWNLOAD,\"upload\":$UPLOAD,\"latency\":$LATENCY,\"packet_loss\":$PACKET_LOSS,\"server\":\"$SERVER_NAME\",\"location\":\"$SERVER_LOCATION\"}" >> "$HISTORY_FILE"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This code transmits speedtest results to an external service using curl, which is a real data exfiltration path. Although posting is gated behind user choice, the transmitted content includes network performance and server/location details, so the risk depends on whether the user fully understands what will be shared.
- Content
sh API_KEY=$(grep -o '"api_key":"[^"]*"' "${HOME}/.config/moltbook/credentials.json" | cut -d'"' -f4) # Post to Moltbook RESPONSE=$(curl -s -X POST https://www.moltbook.com/api/v1/posts \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "{\"submolt\": \"general\", \"title\": \"📊 SpeedTest Results\", \"content\": $(echo "$POST_TEXT" | jq -Rs .)}")
Static analysis
No suspicious patterns detected.