ClawHub
Back to skill

Security audit

Pub

Security checks for vulnerabilities and agentic risk

Overview

The skill’s publishing purpose is coherent, but its setup instructions include unverified remote shell execution and unpinned self-updates that deserve review before installation.

Review before installing. Prefer a pinned GitHub release with checksum or signature verification, avoid running the pipe-to-bash installer, and only publish user-selected content after checking that it contains no secrets, private files, or unintended internal output. Use private pubs by default and stop the live daemon when finished.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:40
Finding

Unverified Remote Installation Script Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 40
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://pub.blue/install.sh | bash

Technical Analysis

The installation instructions stream a mutable remote script directly into Bash. The payload is executed immediately without local inspection, release-version pinning, checksum verification, or cryptographic signature validation.

Although pub.blue matches the project's declared homepage, the effective code resides outside the audited package and can change at any time. Trust in the current domain owner does not protect against later website compromise, DNS or hosting compromise, certificate or deployment errors, or malicious modification of the installer.

This behavior exceeds the minimum privileges needed for the declared functionality. The documentation already identifies GitHub Releases as an alternative installation source, so immediate execution of a mutable web response is unnecessary. The command executes with all privileges available to the user running the shell; if invoked from a privileged session, the downloaded script inherits those elevated privileges.

Attack Path

  1. An attacker compromises the pub.blue website, its deployment pipeline, hosting infrastructure, DNS, or the installer itself.
  2. The attacker replaces or alters https://pub.blue/install.sh with a malicious shell payload.
  3. A user or agent follows the installation instructions in SKILL.md.
  4. curl retrieves the attacker-controlled response and streams it directly to Bash.
  5. Bash executes the payload without an opportunity for inspection or integrity verification.
  6. The payload performs arbitrary actions under the invoking user's privileges.

Impact Assessment

Successful exploitation permits arbitrary command execution with the permissions of the account running the installation command. Potential impact includes: ...[truncated 659 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct pipe-to-shell installation option.
  2. Pin installation instructions to a specific release version rather than using a mutable installer or latest reference.
  3. Download the appropriate release artifact as a separate, non-executing step.
  4. Publish SHA-256 checksums through a separately protected release channel and verify the downloaded artifact before installation.
  5. Prefer cryptographic release signatures with documented signer identity and key verification.
  6. Inspect or explicitly invoke the verified artifact only after integrity checks succeed.
  7. Avoid requiring administrator privileges; install into a user-controlled directory unless system-wide installation is explicitly requested and justified.
  8. If an installer script must remain available, instruct users to download and review it before execution, pin its immutable version, and verify its signature or checksum.

A safer workflow would follow this pattern:

bash
curl -fL -o pub-release.tar.gz "<version-pinned-release-url>"
echo "<trusted-sha256>  pub-release.tar.gz" | sha256sum -c -
tar -xzf pub-release.tar.gz
install -m 0755 pub "$HOME/.local/bin/pub"

The exact artifact URL and checksum must come from a trusted, version-specific release and should not use placeholder values in production instructions.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

curl -fsSL https://pub.blue/install.sh | bash fetches and immediately executes remote code without verification. In a security-sensitive agent environment, this enables full arbitrary code execution if the server, transport, DNS, CDN, or distribution path is compromised, and the skill context encourages exactly this behavior during setup.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Install from GitHub Releases:

https://github.com/xmanatee/pub/releases/latest

Or via install script:

curl -fsSL https://pub.blue/install.sh | bash

Or self-update an existing install:

pub upgrade

text

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash pattern is dangerous because it turns downloaded content directly into shell commands with no inspection or validation step. Within this skill, the pattern is especially risky because it appears as a recommended installation path for a required tool, making accidental arbitrary-code execution likely.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Install from GitHub Releases:

https://github.com/xmanatee/pub/releases/latest

Or via install script:

curl -fsSL https://pub.blue/install.sh | bash

Or self-update an existing install:

pub upgrade

text

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

The skill instructs use of pub upgrade, which performs self-modification by replacing the local CLI with the latest remote release. In an agent context, unpinned self-updates undermine reproducibility and can introduce unreviewed code into the execution environment, especially when the skill explicitly requires using the latest release.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

https://github.com/xmanatee/pub/releases/latest

Or via install script:

curl -fsSL https://pub.blue/install.sh | bash

Or self-update an existing install:

pub upgrade

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation guidance says to use the skill when the user asks about "creating adaptive interfaces, publishing content, or running live sessions on pub.blue." The phrase "publishing content" is broad and could match many ordinary requests unrelated to this specific CLI, and the file does not provide exclusion conditions or narrower trigger examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description broadly states that the skill can 'publish and visualize AI-agent output' and create shareable URLs without clearly constraining when external sharing is appropriate. In an agent setting, vague publishing triggers can lead to unintended disclosure of sensitive model output, user data, or internal artifacts, especially because the skill's purpose is explicitly to expose content over web-accessible and live P2P channels.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.