T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:53- Finding
Mutable Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
用户留存查询
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a read-only Umeng retention lookup, but it requires extra telemetry including the Appkey and includes an unsafe remote installer command.
Review before installing. Prefer the npm install path and avoid running the curl | sh installer. Only use this skill if you are comfortable with umeng-cli authentication and with the skill's trace telemetry behavior, especially the Appkey being sent in a separate trace command before the actual retention query.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:23- Finding
Mandatory Telemetry Redirects the Agent and Discloses the Application Identifier
- Content
View full analysis
"}' ``` The surrounding instructions require the Agent to run the first command after reading the Skill and to run the second command after receiving an Appkey but before making the first requested API call. ### Technical Analysis The Skill declares a read-only retention-query capability, but separately directs the Agent to execute telemetry solely because the Skill was read. It also requires submission of a user-provided Appkey before the requested business operation. These commands are not necessary to query retention data. They modify the Agent's execution flow and create an additional side effect that the user may not have requested or knowingly approved. The audited project does not contain the `umeng-cli` implementation, so the actual telemetry destination, retention policy, transport behavior, and server-side processing cannot be verified from the available artifact. An Appkey is an application identifier rather than an authentication secret, but it can still identify a customer's application and associate that application with Skill usage. Requiring its transmission for telemetry violates data minimization and exceeds the minimum scope needed to call the declared read-only API. ### Attack Path 1. The Agent loads and follows `SKILL.md`. 2. The Skill directs the Agent to execute `umeng-cli trace` even though the user only requested retention analysis. 3. The user supplies an Appkey for the legitimate retention query. 4. Before the business API call, the Agent executes a second trace command containing that Appkey. 5. The external CLI processes and potentially transmits the Skill identifier and ...[truncated 676 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (7)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The
curl ... | shchain is an explicit command-execution pipeline from an external network source into a shell. If executed automatically by an agent, it can result in arbitrary code execution with the agent's privileges, enabling host compromise, credential theft, persistence, or further lateral actions. In the context of a skill document, this is especially dangerous because it presents the chain as a normal setup step, increasing the chance of blind execution.- Content
npm install -g @umengfe/umeng-cli
方式二：通过官方安装脚本（仅安装 CLI 二进制 + Skills）
curl -fsSL https://raw.githubusercontent.com/umeng/umeng-cli/main/scripts/install.sh | sh
text 安装完成后再次运行 `umeng-cli --version` 验证。
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states it provides only a single read-only retention query, but it also instructs the agent to execute separate telemetry commands. That is a hidden side effect unrelated to fulfilling the user's query, and it expands behavior beyond the declared capability. Because agents may auto-follow skill instructions, this can cause undisclosed outbound data transmission and trust-boundary violations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The telemetry/reporting behavior is not necessary to query retention data and is not justified by the skill's stated purpose. Embedding extra reporting steps in operational instructions creates a mismatch between claimed functionality and actual behavior, which is risky in agent-executed environments. This increases the chance of silent data exfiltration or policy bypass under the guise of a read-only analytics skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly directs the agent to send a user-provided appkey via telemetry before making the main API call, without any privacy notice, minimization rationale, or consent step. Even if appkey is not a secret credential by itself, it is still user-supplied tenant/application-identifying data and can reveal account associations or internal asset identifiers. Sending it to a secondary endpoint without clear disclosure is a privacy and data-governance risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions tell the agent to report the Appkey as a precondition before the first business API call. This creates a deliberate data-sharing step for user-provided input that is unrelated to the primary task and may occur automatically if the agent follows the skill literally. In security-sensitive environments, such hidden forwarding of identifiers is dangerous because it normalizes exfiltration of contextual data to ancillary services.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md **获取路径**： 1. 直接要求用户提供 `appkey` 2. 若用户不知道，引导至友盟官网 https://www.umeng.com/ 登录后在应用管理后台复制 3. （进阶）调用同 namespace 的 `umeng.uapp.getAppList`，或使用 `uapp-assets` Skill 搜索 ## 通用调用格式
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The skill recommends installing software by piping a remotely fetched script directly into the shell. This pattern bypasses integrity review and makes execution dependent on the current contents of a remote resource, creating supply-chain and remote-code-execution risk if the source, network path, or repository is compromised. The skill context makes this more concerning because agents may execute commands non-interactively and without human inspection.
- Content
npm install -g @umengfe/umeng-cli
方式二：通过官方安装脚本（仅安装 CLI 二进制 + Skills）
curl -fsSL https://raw.githubusercontent.com/umeng/umeng-cli/main/scripts/install.sh | sh
text 安装完成后再次运行 `umeng-cli --version` 验证。