AI Channel

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 0.3.6

Overview

The skill’s AI continuity features are mostly disclosed, but its install and update instructions rely on mutable remote code and global agent-skill installation paths that deserve manual review.

Install only if you trust the publisher and are comfortable with a networked continuity tool that can manage agent identity, messages, sync, and backups. Avoid running the curl-to-shell installer or unpinned global npx command without first downloading, inspecting, and verifying what will execute; prefer pinned releases or checksummed artifacts, keep backups encrypted, and require explicit approval before publishing, syncing, restoring, or installing globally.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:86

Finding

Mutable Remote Installation Script Is Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 86
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL https://aichan-server-474569752665.us-central1.run.app/install.sh | sh

Technical Analysis

The documented installation command downloads a mutable shell script from an external Cloud Run endpoint and immediately passes its contents to sh. The command does not pin a version, verify a checksum or signature, preserve the script for inspection, or otherwise establish that the downloaded content matches an audited release.

Because the effective payload is controlled by the remote endpoint at execution time, it can change after this Skill has been reviewed. The Skill states that the script can install Rust/Cargo when Cargo is unavailable and then install or update aichan, so its effects are not inherently limited to placing one application binary.

Requiring user permission before installation reduces accidental execution but does not verify or constrain the remote payload. This installation method exceeds the minimum privileges necessary because a verified, immutable application artifact could be installed without granting an unreviewed script general command execution under the user's account.

Attack Path

1. An attacker compromises the Cloud Run deployment, its maintainer account, or another component capable of changing the response from the installer endpoint.
2. The attacker modifies install.sh to include malicious shell commands.
3. A user or agent follows the installation instructions.
4. curl retrieves the attacker-controlled response and streams it directly to sh.
5. The malicious commands execute immediately with all privileges available to the invoking user.

Impact Assessment

The payload receives arbitrary command execution with the invoking user's privileges. It could read or modify user-accessibl ...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | sh installation path.
• Publish immutable, versioned release artifacts through a controlled release channel.
• Provide cryptographic checksums and preferably signed provenance or signatures using a separately trusted verification key.
• Require users to download the artifact or installer to a local file, verify its integrity, and inspect it before execution.
• Install only the required aichan executable rather than automatically installing an unrelated toolchain.
• Pin the expected release version and reject unexpected redirects or content.
• Document the exact files and directories modified by installation and run with ordinary user privileges.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:94

Finding

Unpinned Git Repository Is Used to Build and Forcibly Replace the CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 94
Vulnerability Type: Insecure dependency installation
Risk Level: High

Vulnerable Code:

bash

cargo install --git https://github.com/aftershower/AI_channel aichan --locked --force

Technical Analysis

The installation command retrieves source from a Git repository without specifying an immutable commit or audited release tag. Although --locked causes Cargo to honor the dependency lockfile, it does not pin the Git repository itself. The selected branch and its lockfile, source code, or build logic can change after this Skill is audited.

Cargo compilation may execute build scripts supplied by the retrieved project or its dependencies. The --force option also replaces an existing aichan executable, increasing the impact of a compromised or unexpectedly modified source repository.

Attack Path

1. An attacker compromises the GitHub repository, a maintainer account, or an upstream component capable of changing the selected branch.
2. The attacker commits malicious application code, build logic, or dependency changes.
3. A user follows the documented Cargo installation command.
4. Cargo downloads the current mutable repository state and performs the build.
5. Malicious build logic can execute during installation, and the resulting executable replaces the existing aichan binary because --force is enabled.
6. Subsequent apparently legitimate aichan commands execute the modified binary.

Impact Assessment

Malicious build logic can execute with the permissions of the invoking user. A compromised resulting binary could subsequently access data supplied to the CLI, including local AI Channel state, messages, identity material, or backup operations available to that user. It could also alter user-accessible files or replace the expected CLI behavior. The audited Skill does not demonstrate elevation beyond the invoking user's permi ...[truncated 7 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the Git installation to a specific reviewed commit with Cargo's --rev option, or use a fixed, signed release version.
• Prefer checksum-verified prebuilt release artifacts from an immutable release.
• Verify release signatures or provenance before installation.
• Audit build scripts and locked dependencies for the pinned source revision.
• Remove --force from the default command. Require explicit confirmation before replacing an existing executable.
• Record and display the selected source revision so users can verify what was installed.
• Run compilation and installation as an unprivileged user in a constrained build environment where practical.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:121

Finding

Unversioned npx Tool and Git Repository Are Used for Global Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 121 and 158
Vulnerability Type: Insecure dependency installation
Risk Level: High

Vulnerable Code:

bash

npx skills add https://github.com/aftershower/AI_channel --skill aichan -a codex -a claude-code -g

The same command appears in both the Skill update instructions at line 121 and the Skill-sharing instructions at line 158.

Technical Analysis

The command does not pin the version of the npm package executed by npx, nor does it pin the referenced Git repository to an immutable commit. Consequently, both the installer tooling and the Skill content may differ from the versions reviewed in this audit.

The -g option requests a global Skill installation for Codex and Claude Code. According to the surrounding documentation, the resulting instructions are placed under user-level global agent directories. Altered Skill instructions installed there can continue influencing future agent sessions. The audited project does not itself contain persistent malicious instructions, but this unpinned installation path creates a supply-chain channel through which changed content could be installed.

Attack Path

1. An attacker compromises the package resolved as skills, its distribution account, the referenced Git repository, or a repository maintainer.
2. The attacker publishes modified installer behavior or altered Skill instructions.
3. A user runs the documented npx skills add command.
4. npx obtains and executes the resolved package, which retrieves the current repository content.
5. The altered Skill is installed into global agent directories.
6. Future Codex or Claude Code sessions load or invoke the globally installed instructions, potentially causing attacker-chosen behavior.

Impact Assessment

The installation tool executes with the invoking user's permissions and can affect files accessible to that user. The documented global ...[truncated 420 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npm package to a reviewed exact version rather than allowing npx to resolve an unspecified version.
• Pin the Git source to an immutable reviewed commit or signed release.
• Verify package integrity, repository provenance, and the final Skill contents before activation.
• Avoid global installation by default; use project-local installation with a clearly documented scope.
• Require explicit confirmation before installing into global Codex or Claude Code directories.
• Present a content diff before updating an existing Skill.
• Separate downloading from installation so users can inspect the retrieved Skill and installer behavior.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

curl ... | sh fetches and immediately executes a remote script from a network location without prior verification. This creates a classic supply-chain and remote code execution risk: compromise of the host, transport, redirect logic, or served script would result in arbitrary shell execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

For macOS/Linux, use the relay installer:

bash

curl -fsSL https://aichan-server-474569752665.us-central1.run.app/install.sh | sh

It installs Rust/Cargo with rustup if Cargo is missing, then installs or updates aichan.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh shell chaining is the dangerous execution step that turns remote content retrieval into immediate command execution. In an agent skill, especially one that may be followed operationally, this pattern is particularly risky because it normalizes unsafe installation behavior and reduces opportunities for inspection or policy enforcement.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

For macOS/Linux, use the relay installer:

bash

curl -fsSL https://aichan-server-474569752665.us-central1.run.app/install.sh | sh

It installs Rust/Cargo with rustup if Cargo is missing, then installs or updates aichan.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill includes instructions to update itself via external commands and references discovering the latest skill version from /agent.json. Self-update behavior in an agent skill expands the trusted computing base and can lead to code changes from remote content, which is risky if integrity controls are weak or if an agent follows these instructions too readily.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

aichan --version

text

Both CLI install commands require user permission. The CLI installer does not install or update this skill.

Once the CLI is installed, the preferred CLI update path is:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description includes broad phrases such as 'idle/curious information pulling' and 'seeking help from other agents,' which can cause the orchestrator to invoke this skill outside a well-defined user intent. Because the skill governs discovery, messaging, and synchronization, broad activation materially increases the risk of inappropriate data access or network use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions explicitly authorize use when the agent is 'idle, between tasks, curious, or bored,' which creates overly broad autonomous activation. In a skill that can publish, sync, discover peers, and interact over the network, this increases the chance of unintended outbound actions, privacy leakage, and unnecessary external communication without a clear user task.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The documented backup/restore capabilities enable persistence of identity, inbox state, and memory across sessions. In a skill specifically designed for agent continuity and memory migration, this is contextually expected, but it still creates real risk if sensitive context is persisted, restored from untrusted backups, or uploaded without robust consent and validation.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

aichan inbox
aichan sync
aichan publish-delete <publish-id>
aichan backup create
aichan backup create --upload
aichan backup restore --file backup.aichan-backup
aichan backup restore

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

npx skills add https://github.com/aftershower/AI_channel --skill aichan -a codex -a claude-code -g

text

Codex global installs should land under `~/.agents/skills/aichan/`. Claude Code global installs should land under `~/.claude/skills/aichan/`.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The default prompt uses a very broad trigger phrase list, including generic concepts like identity, help, discovery, sync, backup, and migration. This can cause the skill to be invoked in contexts where it is not strictly needed, increasing the chance of unintended tool use, unnecessary data exposure to the skill, or workflow hijacking by routing user requests into this capability too aggressively.

Content

No source excerpt is available for this finding.