Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a lottery-analysis helper, but its developer instructions include an unsafe remote installer command that users should review before installing.
Review this skill before installing. Do not run the documented `curl | sh` installer unless you have independently verified the installer source and integrity. Expect the skill to work with public lottery data, local CSV caches, and generated chart files; also treat generated number recommendations as entertainment, not reliable predictions.
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
T03 · Remote Payload Retrieval and Execution
Error
Location
AGENTS.md:25
Finding
Unverified Remote Installer Piped Directly into a Shell
Content
View full analysis
Vulnerability Details
File Location: AGENTS.md, line 25 Vulnerability Type: Remote payload retrieval and execution Risk Level: High
Vulnerable code:
bash
curl -fsSL https://skillhub.cn/install/skillhub.md | sh
Technical Analysis
The installation instructions download a mutable response from https://skillhub.cn/install/skillhub.md and immediately pass it to sh. There is no version pinning, cryptographic signature or checksum verification, local review step, or immutable artifact reference.
Consequently, the code ultimately executed is not contained in the audited project and can change after review. The repository itself provides no evidence sufficient to establish the ongoing integrity or trustworthiness of the remote installer. The use of an HTTPS URL protects the connection under normal conditions but does not protect against compromise of the remote domain, hosting account, release process, or signing infrastructure.
This behavior is not necessary for the Skill's declared lottery filtering, analysis, result-querying, number-generation, or chart-generation functionality. It is only part of an optional publishing workflow and therefore exceeds the minimum execution privileges required by the Skill.
Attack Path
An attacker compromises the remote server, its deployment process, the associated domain, or another component capable of controlling the installer response.
The attacker replaces the expected installer content with malicious shell commands.
A user follows the documented installation instructions.
curl downloads the attacker-controlled response.
The pipe sends that response directly to sh without inspection or integrity verification.
The malicious commands execute with the privileges of the user who ran the command.
Impact Assessment
Successful exploitation provides arbitrary command execution under the invoking user's account. The accessible
...[truncated 625 chars]
Remediation
View remediation
Remediation Suggestions
Remove the direct curl | sh pipeline from the documentation.
Prefer installation through a reputable package manager using an explicitly pinned version.
If a standalone installer is required, publish an immutable, versioned artifact rather than a mutable endpoint.
Download the artifact as a separate step so users can inspect it before execution.
Publish a cryptographic checksum through an independently protected channel and require verification before execution.
Prefer a verifiable digital signature over a checksum alone, and document how users must validate the signing identity.
Run the installer without administrative privileges unless a specific operation demonstrably requires elevation.
Document the files, directories, network endpoints, and permissions used by the installer.
A safer workflow would resemble:
bash
curl -fSLo skillhub-installer.sh \
https://example.invalid/releases/vX.Y.Z/skillhub-installer.sh
sha256sum --check skillhub-installer.sh.sha256
less skillhub-installer.sh
sh skillhub-installer.sh
Replace the placeholder URL with an immutable official release and obtain the checksum or signature from a separately authenticated source.
The documentation instructs users to fetch a remote script and immediately pipe it to a shell for execution. This bypasses integrity verification and gives the remote server or any attacker who can tamper with the download path the ability to run arbitrary commands on the user's system. In a skill package, this is especially risky because users may trust setup instructions and execute them without review.
Content
Scanner excerpt · AGENTS.md (reported line 25)May include surrounding context.
The | sh construct is a direct command-chaining pattern that executes untrusted network content as shell code. This removes any opportunity for review and turns a documentation snippet into a one-step remote code execution path if the source is compromised, redirected, or maliciously changed. Because this appears in agent skill documentation, it increases the chance that operators will copy and run it as-is.
Content
Scanner excerpt · AGENTS.md (reported line 25)May include surrounding context.
The description broadly matches the domain and some core functions: the script supports the declared lottery types, computes hot/cold-style statistics, generates recommendation numbers, and queries specified or latest historical results. However, several prominent claimed capabilities are not implemented. There is no actual condition-based filtering engine for odd/even, size, intervals, consecutive numbers, primes, etc.; no胆拖/复式 generator; and only limited analysis rather than full trend analysis. The 'latest' query simply returns the last row of a local CSV, not necessarily current live results. So the description overstates the implemented functionality enough to constitute a mismatch, though the overall topic and primary purpose are aligned.
Content
No source excerpt is available for this finding.
Ae1
High
Category
analysis-evasion
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected
Content
Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.
Without declared permissions the skill's intent is opaque and cannot be validated.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The trigger description is extremely broad, causing the skill to activate on generic lottery-related mentions without strong scope boundaries. Over-broad activation can route unrelated conversations into this skill unexpectedly, increasing the chance of incorrect handling, user confusion, and unintended use of any associated tools or local data paths.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The automatic recognition rules use ambiguous keywords such as 任选, 和值, 3D, and even map unrelated terms like 大乐透 to 双色球, which can misclassify user intent. In a tool-using agent, this increases the risk of unintended invocation, wrong data handling, and misleading outputs because the agent may perform the wrong workflow based on vague matches.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
95% confidence
Finding
This code file contains natural-language instructions that effectively force a specific language/locale for usage and output. Under the policy, locale constraints should either offer user choice or be clearly justified as region-specific; this file provides neither.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
94% confidence
Finding
This code file contains natural-language instructions and labels that force a specific language/locale for all users. The policy allows locale constraints only when justified or when users are given a choice, neither of which is present here.
