Helm

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:33 AM UTC
• Version: 3.0.1

Overview

This Helm helper is mostly coherent, but it needs Review because it can affect live Kubernetes releases, including rollbacks, while its top-level description understates that authority.

Review this before installing if you use Helm against real clusters. Treat list/status/values/history/diff as cluster-reading commands and rollback as production-impacting. Use a least-privilege kubeconfig and namespace, avoid running rollback through automation unless you have separately confirmed the target cluster and revision, and do not follow the printed curl-to-bash Helm install command without independent verification.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/script.sh:77
• Finding: Unverified Remote Installer Piped Directly to Bash<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:77` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash echo " curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash" ``` ### Technical Analysis When Helm is unavailable, the Skill prints an installation command that retrieves a shell script from the mutable `main` branch of Helm's GitHub repository and immediately pipes it into Bash. The command is presented as guidance rather than executed automatically by `script.sh`. Nevertheless, users or agents following the documented workflow would execute remote content without an inspection step, immutable version pin, checksum validation, or signature verification. The effective payload can therefore change after this Skill has been reviewed. Although the referenced repository is the official Helm repository, trust in the current upstream source does not eliminate the supply-chain risk. A compromised repository, maintainer account, branch, distribution path, or installer could turn this command into arbitrary code execution. This behavior exceeds the minimum privileges necessary to notify the user that Helm is required. Safer installation instructions can avoid granting mutable remote content immediate shell execution. ### Attack Path 1. The user invokes a Skill command on a system where Helm is not installed. 2. `_check_helm` detects the missing executable and displays the `curl | bash` installation command. 3. The user or an automated agent copies and executes the suggested command. 4. `curl` retrieves the current installer from the remote `main` branch. 5. Bash executes the downloaded response immediately, without integrity or authenticity verification. 6. If the upstream source or delivery path has been compromised, attacker-controlled commands execute with the privileges of the invoking user and may potentially trigger privileged installation op ...[truncated 625 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` recommendation. 2. Prefer installation through an operating-system package manager or another trusted, auditable distribution channel. 3. If direct installation is necessary: - Pin the download to a specific Helm release rather than a mutable branch. - Download the artifact and checksum as separate files. - Verify the checksum and, where available, the publisher's cryptographic signature. - Abort installation if verification fails. - Execute or install the artifact only after successful verification. 4. Clearly separate download, verification, and execution into distinct commands so users can inspect the retrieved content. 5. Avoid recommending administrator privileges unless they are strictly required, and document the exact files and directories that installation will modify. 6. Link users to Helm's official installation documentation instead of embedding an unverified remote execution pipeline. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description presents the skill as a local Helm chart utility, but the documented commands also interact with live clusters and repositories, including listing releases, reading deployed state, and performing rollbacks. This mismatch can mislead users into approving or invoking the skill without understanding that it can affect real environments and external registries.

Credential Access

High

• Category: Privilege Escalation

Content

## Commands

### `KUBECONFIG`

Path to kubeconfig file

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Commands

### `KUBECONFIG`

Path to kubeconfig file

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Commands

### `KUBECONFIG`

Path to kubeconfig file

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Commands

### `KUBECONFIG`

Path to kubeconfig file

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Commands

### `KUBECONFIG`

Path to kubeconfig file

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Commands

### `KUBECONFIG`

Path to kubeconfig file

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Commands

### `KUBECONFIG`

Path to kubeconfig file

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Commands

### `KUBECONFIG`

Path to kubeconfig file

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### `KUBECONFIG`

Path to kubeconfig file

```bash
scripts/script.sh KUBECONFIG

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### `KUBECONFIG`

Path to kubeconfig file

```bash
scripts/script.sh KUBECONFIG

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### `KUBECONFIG`

Path to kubeconfig file

```bash
scripts/script.sh KUBECONFIG

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### `KUBECONFIG`

Path to kubeconfig file

```bash
scripts/script.sh KUBECONFIG

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Rollback is a cluster-changing, potentially production-impacting operation that is not justified by the stated purpose of chart scaffolding, linting, templating, or packaging. In this context, the capability is especially dangerous because it can alter live release state and trigger service disruption or rollback to insecure or broken revisions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exposes shell-backed operational capabilities but does not declare any tool scope such as permissions or allowed-tools. This makes the effective execution surface opaque to users and policy systems, increasing the risk of unintended command execution or broader-than-expected access.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest description omits repository-management and cluster-management functions that are materially more sensitive than local chart scaffolding. In security-sensitive environments, incomplete disclosure reduces informed consent and can bypass user expectations or governance controls.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Several commands can modify local files, Helm repository configuration, or cluster-related state, but the skill does not warn users about these side effects. Lack of warnings is dangerous because users may treat the skill as informational when some operations are administrative or destructive.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script exposes live cluster-management commands such as list, status, history, rollback, and manifest retrieval even though the skill description is focused on chart creation, linting, templating, and packaging. This scope expansion increases operational risk because a user invoking a seemingly chart-focused helper can unexpectedly interact with production clusters and release state.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo ""
        echo "  Or via package manager:"
        echo "    macOS:         brew install helm"
        echo "    Snap:          sudo snap install helm --classic"
        echo "    Chocolatey:    choco install kubernetes-helm"
        echo "    apt (Debian):  sudo apt-get install helm"
        echo ""

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo ""
        echo "  Or via package manager:"
        echo "    macOS:         brew install helm"
        echo "    Snap:          sudo snap install helm --classic"
        echo "    Chocolatey:    choco install kubernetes-helm"
        echo "    apt (Debian):  sudo apt-get install helm"
        echo ""

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The rollback path executes a state-changing Helm rollback immediately after collecting or receiving a revision, but it does not require a final confirmation acknowledging the target cluster and consequences. This makes accidental destructive actions more likely, especially in automation or when the user assumes the helper is primarily read-only/chart-local.

Description-Behavior Mismatch

Low

• Confidence: 92% confidence
• Finding: The script includes repository mutation and remote search features not declared in the manifest description, which broadens network and configuration side effects beyond what a user would reasonably expect from a chart scaffolding/linting helper. While less severe than rollback, undeclared remote operations still weaken trust boundaries and increase attack surface.

External Script Fetching

Low

• Category: Supply Chain

Content

_error "helm is not installed or not in PATH."
        echo ""
        echo "Install Helm v3:"
        echo "  curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash"
        echo ""
        echo "  Or via package manager:"
        echo "    macOS:         brew install helm"

• Confidence: 15% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Static analysis

No suspicious patterns detected.