Vnstock Environment Setup for Python Vibe Coding

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:01 AM UTC
• Version: 1.0.0

Overview

This setup skill can run unverified remote installers and permanently rewrite repository and agent files, so it should be reviewed carefully before installation.

Install only after reviewing the scripts and remote sources. Prefer running diagnostics only, and avoid the sponsor curl/wget-to-bash path unless the installer is pinned and verified. Do not run the guide installer in an important repository without a separate backup, a clean Git status, and explicit approval for every file or skill it will replace.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:32
• Finding: Remote Sponsor Installer Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32, 129, and 132 **Vulnerability Type**: Remote code retrieval followed by immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```markdown | **6. Sponsor Tier Setup** | **Linux**: `wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Mac**: `curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Win (PowerShell)**: `pip install -r https://vnstocks.com/files/requirements.txt; pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer; py -m vnstock_installer` | ``` ```bash # Linux wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept # Mac curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept ``` ### Technical Analysis The installation instructions stream content from a mutable external URL directly into Bash. The downloaded script is not pinned to a version and is not verified using a cryptographic checksum, digital signature, or trusted release manifest. The user and Agent therefore cannot determine whether the executed content matches the content that was originally reviewed. TLS protects the connection in transit but does not protect against compromise of the hosting server, DNS or certificate infrastructure, deployment pipeline, or publisher account. The effective payload can also be replaced legitimately or maliciously after this Skill has been audited. The commands pass the sponsor API key as a command-line argument. Depending on the operating system and execution environment, command-line arguments can be exposed through process inspection, terminal logs, shell history, Agent execution logs, or monitoring systems. This behavior exceeds what is necessary for ...[truncated 1645 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` and `wget | bash` instructions. 2. Publish immutable, versioned installer artifacts through a controlled release process. 3. Download the installer to a temporary file without executing it: ```bash curl -fL -o vnstock-installer.run \ https://vnstocks.com/files/releases/VERSION/vnstock-cli-installer.run ``` 4. Publish the expected SHA-256 digest through a separately protected release manifest and verify it before execution: ```bash printf '%s %s\n' 'PINNED_SHA256' 'vnstock-installer.run' | sha256sum --check - ``` 5. Prefer a verifiable publisher signature over a checksum alone. Pin the signing key and verify the signature locally. 6. Show the artifact path, version, origin, and verification result to the user and require explicit approval before execution. 7. Run the installer without elevated privileges and inside the intended virtual environment. 8. Do not put API keys on the command line. Use protected standard input, an interactive prompt, or a permission-restricted configuration file. 9. Document precisely which files, network endpoints, and commands the installer uses. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup_agent_guide.py:64
• Finding: Unpinned Remote Repository Can Replace Agent Instructions and Local Skills<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_agent_guide.py`, lines 64-101 **Vulnerability Type**: Mutable remote content installation and Agent instruction replacement **Risk Level**: Critical ### Vulnerable Code ```python def install_agent_guide(): repo_url = "https://github.com/vnstock-hq/vnstock-agent-guide.git" with tempfile.TemporaryDirectory() as temp_dir: print(f"📥 Cloning repository to {temp_dir}...") run_cmd(["git", "clone", repo_url, temp_dir]) cwd = os.getcwd() # 1. Copy root files for file in ["AGENTS.md", "CLAUDE.md"]: src = os.path.join(temp_dir, file) # Only copy if file exists in the repo if os.path.exists(src): shutil.copy2(src, os.path.join(cwd, file)) print(f"✅ Copied {file}") # 2. Copy specific skills to avoid overwriting user's custom skills skills_to_copy = [ "vnstock-solution-architect", "vnstock-migration-expert", "vnstock-env-setup" ] dest_skills_dir = os.path.join(cwd, ".agents", "skills") os.makedirs(dest_skills_dir, exist_ok=True) for skill in skills_to_copy: src_skill = os.path.join(temp_dir, ".agents", "skills", skill) dest_skill = os.path.join(dest_skills_dir, skill) if os.path.exists(src_skill): if os.path.exists(dest_skill): shutil.rmtree(dest_skill) shutil.copytree(src_skill, dest_skill) print(f"✅ Copied skill: {skill}") # 3. Copy docs directory (Overwrite) src_docs = os.path.join(temp_dir, "docs") dest_docs = os.path.join(cwd, "docs") if os.path.exists(src_docs): if os.path.exists(dest_docs): shutil.rmtree(dest_docs) shutil.copytree(src_docs, dest_docs) ...[truncated 2316 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the repository to a specific audited commit hash rather than cloning the mutable default branch. 2. Verify a signed commit or signed release against a pinned, trusted maintainer key. 3. Maintain an allowlist of expected files and verify a published cryptographic hash for each file. 4. Clone without hooks and without unnecessary history, then explicitly check out the pinned commit. 5. Present a complete diff for `AGENTS.md`, `CLAUDE.md`, each Skill, and `docs` before changing the workspace. 6. Require explicit, per-target approval before replacing Agent instructions or Skill directories. 7. Install into a staging directory first. Do not delete existing content until integrity verification and approval have succeeded. 8. Preserve local modifications by default. Refuse replacement when uncommitted or divergent local content exists unless the user explicitly approves it. 9. Treat remote Agent instructions as executable security-sensitive content and subject them to the same review process as source code. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:31
• Finding: Unpinned Requirements and Additional Package Index Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31-32 and 111-138 **Vulnerability Type**: Unverified remote dependencies and unsafe package resolution **Risk Level**: High ### Vulnerable Code ```markdown | **4. Install Dependencies**| `pip install -r https://vnstocks.com/files/requirements.txt` | | **5. Free Tier Setup** | `pip install vnstock -U` | | **6. Sponsor Tier Setup** | **Linux**: `wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Mac**: `curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Win (PowerShell)**: `pip install -r https://vnstocks.com/files/requirements.txt; pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer; py -m vnstock_installer` | ``` ```bash pip install -r https://vnstocks.com/files/requirements.txt ``` ```bash pip install vnstock -U ``` ```powershell pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer py -m vnstock_installer ``` ### Technical Analysis The requirements file is retrieved from a mutable URL at installation time. The reviewed Skill does not establish that its entries use exact versions and cryptographic hashes. The direct `pip install vnstock -U` command deliberately resolves the newest available version rather than an audited version. The sponsor setup adds a secondary package index using `--extra-index-url`. Pip can consider candidates from all configured indices, and it does not inherently treat one index as a secure namespace owner. If package names overlap or an unintended candidate has a preferred version, package resolution may select content from an unexpected source. Package installation can execute package build backends and installation-time code. The audit does not establish that the referenced packages or server are malicious. The vulnerability is the absence of immutable dependency ...[truncated 1195 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store a reviewed lock file in the Skill package rather than loading a mutable requirements file from a URL. 2. Pin every direct and transitive dependency to an exact version. 3. Require hashes for every distribution, for example with Pip's `--require-hashes`. 4. Prefer a single trusted index. If a private index is required, isolate private package resolution instead of combining it with public sources through `--extra-index-url`. 5. Reserve and monitor private package names across all relevant public indices to reduce dependency-confusion exposure. 6. Pin `vnstock` and `vnstock_installer` to audited versions rather than using `-U` or unconstrained resolution. 7. Prefer prebuilt, signed wheels and disable source builds unless they are explicitly required and reviewed. 8. Verify package publisher signatures or trusted provenance attestations where available. 9. Generate and retain a software bill of materials for the resolved environment. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/setup_agent_guide.py:14
• Finding: Setup Script Automatically Installs System Software and Runs an Unverified Windows Executable<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_agent_guide.py`, lines 14-34 **Vulnerability Type**: Unverified executable installation and unnecessary privilege expansion **Risk Level**: High ### Vulnerable Code ```python def check_and_install_git(): try: run_cmd(["git", "--version"]) print("✅ Git is installed.") except Exception: print("❌ Git is not installed. Attempting to install...") sys_os = platform.system() if sys_os == "Darwin": run_cmd(["brew", "install", "git"]) elif sys_os == "Linux": run_cmd(["sudo", "apt-get", "update"]) run_cmd(["sudo", "apt-get", "install", "-y", "git"]) elif sys_os == "Windows": print("Downloading Git for Windows...") run_cmd(["powershell", "-Command", "Invoke-WebRequest -Uri https://github.com/git-for-windows/git/releases/download/v2.44.0.windows.1/Git-2.44.0-64-bit.exe -OutFile git_installer.exe"]) print("Installing Git...") run_cmd(["powershell", "-Command", "Start-Process -FilePath .\\git_installer.exe -ArgumentList '/VERYSILENT /NORESTART /NOCANCEL /SP- /CLOSEAPPLICATIONS /RESTARTAPPLICATIONS' -Wait"]) if os.path.exists("git_installer.exe"): os.remove("git_installer.exe") print("✅ Git installation attempted.") ``` ### Technical Analysis On Linux, the script invokes `sudo apt-get`, crossing from workspace-level guide installation into privileged system package management. On macOS, it modifies the Homebrew environment. On Windows, it downloads an executable and performs a silent installation without checking a cryptographic digest or Authenticode signature. The pre-scan characterization of the Windows source as a personal code-hosting or pastebin site is not supported by the reviewed code. The URL is a versioned Git-for-Windows GitHub release URL. Nevertheless, the executable is trusted solely based on its HTTPS locati ...[truncated 1625 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not automatically install system prerequisites from the Agent guide setup script. 2. If Git is missing, stop with a clear message and provide platform-specific, user-reviewed installation guidance. 3. Require explicit confirmation immediately before any package-manager or installer operation. 4. Never invoke `sudo` automatically. Let the user initiate privileged package installation separately. 5. On Windows, download to a securely created temporary directory using an absolute path. 6. Verify the executable's pinned SHA-256 digest and Authenticode publisher signature before execution. 7. Avoid silent installation by default so the user can review the publisher and requested changes. 8. Pin supported Git versions and update them through a reviewed release process. 9. Delete temporary installers in a `finally` block, including when installation fails. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup_agent_guide.py:36
• Finding: Guide Installation Stages the Entire Workspace and Destructively Replaces Local Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_agent_guide.py`, lines 36-59 and 74-101 **Vulnerability Type**: Excessive workspace mutation and unsafe backup procedure **Risk Level**: High ### Vulnerable Code ```python def ensure_git_backup(): if not os.path.exists(".git"): print("📦 No Git repository found. Initializing new repository...") run_cmd(["git", "init"]) run_cmd(["git", "add", "."]) # Need to handle edge case where identity is not configured subprocess.run(["git", "config", "user.email", "[e-mail]"], capture_output=True) subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True) res = subprocess.run(["git", "commit", "-m", "Initial commit before Agent Guide installation"], capture_output=True) if res.returncode == 0: print("✅ Initial commit created.") else: print("📦 Git repository detected. Creating backup commit...") run_cmd(["git", "add", "."]) subprocess.run(["git", "config", "user.email", "[e-mail]"], capture_output=True) subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True) res = subprocess.run(["git", "commit", "-m", "Backup workspace before Agent Guide installation"], capture_output=True) if res.returncode == 0: print("✅ Workspace backed up in a commit.") else: print("ℹ️ Working tree clean. Nothing to commit.") ``` ```python for file in ["AGENTS.md", "CLAUDE.md"]: src = os.path.join(temp_dir, file) if os.path.exists(src): shutil.copy2(src, os.path.join(cwd, file)) print(f"✅ Copied {file}") ``` ```python for skill in skills_to_copy: src_skill = os.path.join(temp_dir, ".agents", "skills", skill) dest_skill = os.path.join(dest_skills_dir, skill) if os.path.exists(src_skill): if os.path.exists(dest_skill): shutil.rmtree(dest_skill) ...[truncated 2711 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not run `git add .` or commit the entire workspace as an installation side effect. 2. Back up only files and directories that the installer intends to modify. 3. Store backups in a dedicated, permission-restricted archive outside Git history. 4. Enumerate all files that will be created, replaced, or deleted and request explicit approval. 5. Preserve existing repository identity settings; do not overwrite `user.name` or `user.email`. 6. Check every Git subprocess result and distinguish a clean tree from commit failures. 7. Abort all destructive operations unless backup creation is positively verified. 8. Use staging paths and atomic renames rather than deleting destination directories before a successful copy. 9. Require separate confirmation for `AGENTS.md`, `CLAUDE.md`, every existing Skill directory, and `docs`. 10. Detect local modifications and produce a diff or conflict report instead of replacing them automatically. 11. Recommend secret scanning before any user-authorized Git commit. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims environment diagnostics and setup, but the documented workflow includes materially riskier actions such as modifying git state, fetching remote content, and overwriting local docs/skills. Misrepresenting destructive or network-active behavior reduces informed consent and can trick operators into authorizing repository changes they did not expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims environment diagnostics and setup, but the documented workflow includes materially riskier actions such as modifying git state, fetching remote content, and overwriting local docs/skills. Misrepresenting destructive or network-active behavior reduces informed consent and can trick operators into authorizing repository changes they did not expect.

External Script Fetching

High

• Category: Supply Chain

Content

| **3. Create Venv (Win)**| `py -m venv $env:USERPROFILE\.venv; & "$env:USERPROFILE\.venv\Scripts\Activate.ps1"` |
| **4. Install Dependencies**| `pip install -r https://vnstocks.com/files/requirements.txt` |
| **5. Free Tier Setup** | `pip install vnstock -U` |
| **6. Sponsor Tier Setup** | **Linux**: `wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Mac**: `curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Win (PowerShell)**: `pip install -r https://vnstocks.com/files/requirements.txt; pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer; py -m vnstock_installer` |
| **7. Agent Guide Install** | **Mac/Linux:** `python3 .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py --confirm-docs-overwrite`<br>**Win:** `py .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py --confirm-docs-overwrite` |

---

• Confidence: 99% confidence
• Finding: The Linux variant using wget piped to bash has the same remote-code-execution and supply-chain risks as the curl variant. Because it is embedded in the quick-reference table, it normalizes a highly dangerous pattern as a standard install command.

External Script Fetching

High

• Category: Supply Chain

Content

| **3. Create Venv (Win)**| `py -m venv $env:USERPROFILE\.venv; & "$env:USERPROFILE\.venv\Scripts\Activate.ps1"` |
| **4. Install Dependencies**| `pip install -r https://vnstocks.com/files/requirements.txt` |
| **5. Free Tier Setup** | `pip install vnstock -U` |
| **6. Sponsor Tier Setup** | **Linux**: `wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Mac**: `curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Win (PowerShell)**: `pip install -r https://vnstocks.com/files/requirements.txt; pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer; py -m vnstock_installer` |
| **7. Agent Guide Install** | **Mac/Linux:** `python3 .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py --confirm-docs-overwrite`<br>**Win:** `py .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py --confirm-docs-overwrite` |

---

• Confidence: 99% confidence
• Finding: The Linux variant using wget piped to bash has the same remote-code-execution and supply-chain risks as the curl variant. Because it is embedded in the quick-reference table, it normalizes a highly dangerous pattern as a standard install command.

External Script Fetching

High

• Category: Supply Chain

Content

**If they are a Sponsor User (requires API key):**
```bash
# Linux
wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept

# Mac
curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept

• Confidence: 99% confidence
• Finding: This is another instance of unverified remote script execution in the detailed sponsor workflow. The skill context amplifies the risk because the agent is being instructed to automate setup, so a user may approve the workflow expecting benign installation while actually authorizing arbitrary code from an external server.

External Script Fetching

High

• Category: Supply Chain

Content

wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept

# Mac
curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept

# Windows (PowerShell)
pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer

• Confidence: 99% confidence
• Finding: This repeats the same unsafe remote-script execution pattern in the main workflow, increasing the likelihood it will actually be used. The surrounding context makes it more dangerous because it is presented as the required sponsor installation path, encouraging execution of unverified code during setup.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill directs the agent to run shell commands, inspect the environment, and overwrite workspace content, but it declares no explicit tool scope or permission boundaries. That creates a confused-deputy risk where a caller may not realize the skill can execute commands and modify files, increasing the chance of unsafe or over-broad execution.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The manifest description states the skill is 'Fully English documented,' which imposes a language constraint in natural language. The file elsewhere also mixes Vietnamese prompts, so the English-only framing is not clearly justified as a region-specific requirement or presented as a user choice.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Vnstock Environment Setup & Diagnostics

> **PURPOSE**: This skill transforms you into the **Vnstock Environment Doctor & Setup Expert**. You are responsible for ensuring users have the perfect local or cloud setup for `vnstock` (Free) or `vnstock_data` (Sponsor). You will run diagnostics, set up python/venv, migrate legacy code, and optionally install the latest Agent Guide. **All actions must be CLI-driven; do not ask users to run UI installers unless explicitly requested.**

## ⚡ TRIGGER DETECTION

• Confidence: 80% confidence
• Finding: The skill strongly pushes autonomous setup actions and discourages asking the user to perform steps themselves. In a skill that installs software, creates virtual environments, and may overwrite files, this increases the chance the agent will take impactful actions without sufficiently granular consent or review.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. **Request Permission:** If `docs/` exists, you MUST pause and ask the user (e.g. using `notify_user`): *"Thư mục `docs/` đã tồn tại. Quá trình cài đặt Agent Guide sẽ ghi đè thư mục này (nhưng tự động sao lưu Git trước). Bạn có đồng ý không?"*
3. **Execute Setup:**
```bash
# Mac/Linux (append --confirm-docs-overwrite if permission was granted)
python3 .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py

```powershell

• Confidence: 81% confidence
• Finding: The workflow persists changes to the workspace by running a setup script that can overwrite docs and, per the surrounding instructions, may also create git backups. Persistent modification of user repositories is security-relevant because it can introduce unreviewed content, alter project behavior, or mask provenance of changes.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

for pkg in packages:
        try:
            mod = __import__(pkg)
            version = getattr(mod, '__version__', 'unknown')
            print(f"✅ {pkg:16} : Installed (v{version})")
            if pkg == 'vnstock': is_free = True

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(cmd, check=True):
    print(f"Executing: {' '.join(cmd)}")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if check and result.returncode != 0:
        print(f"Error executing {' '.join(cmd)}:")
        print(result.stderr)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This setup script performs powerful side effects beyond simple guide installation: it installs system software, initializes repositories, stages all files, changes Git config, and creates commits. That expanded capability is risky because a user invoking a documentation/setup tool would not reasonably expect OS-level changes and durable version-control mutation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script can perform automatic OS-level package installation using brew, apt-get with sudo, and PowerShell-downloaded installers. For an agent guide setup script, this is unusually privileged behavior that expands the attack surface to system-wide changes and remote binary installation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

run_cmd(["git", "init"])
        run_cmd(["git", "add", "."])
        # Need to handle edge case where identity is not configured
        subprocess.run(["git", "config", "user.email", "[e-mail]"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Initial commit before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:

• Confidence: 91% confidence
• Finding: The script silently changes Git configuration in the current repository by setting user.email without explicit user consent. In a setup script, modifying repository metadata can tamper with audit trails and cause future commits to be attributed to an unexpected identity.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Silently configuring Git identity inside the user's repository is a hidden state change with provenance implications. In the context of an environment/setup helper, this is more dangerous because users may trust it as non-invasive while it modifies audit-relevant configuration.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

run_cmd(["git", "add", "."])
        # Need to handle edge case where identity is not configured
        subprocess.run(["git", "config", "user.email", "[e-mail]"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Initial commit before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:
            print("✅ Initial commit created.")

• Confidence: 91% confidence
• Finding: This line silently sets user.name in the user's repository, altering commit attribution. Even though it is not code execution, it changes version-control state in a way that is unnecessary for a guide installer and can mislead later provenance or compliance reviews.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Need to handle edge case where identity is not configured
        subprocess.run(["git", "config", "user.email", "[e-mail]"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Initial commit before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:
            print("✅ Initial commit created.")
    else:

• Confidence: 90% confidence
• Finding: The script automatically creates a Git commit over the entire working tree, potentially capturing unrelated files, secrets, or in-progress work. Because this occurs as part of a setup flow, users may not expect broad repository mutation or the creation of durable history entries.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        print("📦 Git repository detected. Creating backup commit...")
        run_cmd(["git", "add", "."])
        subprocess.run(["git", "config", "user.email", "[e-mail]"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Backup workspace before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:

• Confidence: 91% confidence
• Finding: This repeats the same silent repository identity modification in an existing Git repository. In context, that is more dangerous because it affects an already-established project and can unexpectedly alter future commit attribution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("📦 Git repository detected. Creating backup commit...")
        run_cmd(["git", "add", "."])
        subprocess.run(["git", "config", "user.email", "[e-mail]"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Backup workspace before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:
            print("✅ Workspace backed up in a commit.")

• Confidence: 91% confidence
• Finding: This line sets the repository's user.name without notice during a backup operation. That is an unnecessary side effect for installing documentation/skills and can interfere with repository ownership and audit expectations.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

run_cmd(["git", "add", "."])
        subprocess.run(["git", "config", "user.email", "[e-mail]"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Backup workspace before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:
            print("✅ Workspace backed up in a commit.")
        else:

• Confidence: 90% confidence
• Finding: The script creates a backup commit in the user's existing repository after running git add ., which can capture all current changes rather than only installer-related files. This can expose sensitive or unfinished work to repository history and makes the setup script unexpectedly state-changing.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script deletes and replaces local skill directories and fully overwrites the docs directory with content from a remote repository. This is dangerous because it can destroy local customizations and trust remote content without pinning, review, or granular confirmation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: These lines delete existing local skill directories and replace them without an explicit user-facing warning or per-item confirmation. In an agent skill ecosystem, that can remove user-authored logic and substitute remotely sourced behavior, increasing both data-loss and supply-chain risk.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The skill says 'All actions must be CLI-driven; do not ask users to run UI installers unless explicitly requested.' This is a natural-language constraint on interaction mode that may override user preference without offering a choice or documenting a policy reason.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

Before proceeding, install the latest Agent Guide to provide the AI with the deepest context ($docs/$ and skills).

1. **Check for existing docs:** `ls -d docs/ 2>/dev/null`
2. **Request Permission:** If `docs/` exists, you MUST pause and ask the user (e.g. using `notify_user`): *"Thư mục `docs/` đã tồn tại. Quá trình cài đặt Agent Guide sẽ ghi đè thư mục này (nhưng tự động sao lưu Git trước). Bạn có đồng ý không?"*
3. **Execute Setup:**
```bash
# Mac/Linux (append --confirm-docs-overwrite if permission was granted)

• Confidence: 80% confidence
• Finding: The agent-guide installation flow implies broad write and repository-modification capability, including backup/commit behavior and overwriting docs, without clearly constraining what may be changed. Even with a docs overwrite prompt, the effective permission scope is wider than necessary for a diagnostic/setup skill.

Static analysis

No suspicious patterns detected.