T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/script.sh:77- Finding
Unverified Remote Installer Piped Directly to Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Helm
Security checks for vulnerabilities and agentic risk
Overview
This Helm helper is mostly coherent, but it needs Review because it can affect live Kubernetes releases, including rollbacks, while its top-level description understates that authority.
Review this before installing if you use Helm against real clusters. Treat list/status/values/history/diff as cluster-reading commands and rollback as production-impacting. Use a least-privilege kubeconfig and namespace, avoid running rollback through automation unless you have separately confirmed the target cluster and revision, and do not follow the printed curl-to-bash Helm install command without independent verification.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the skill as a local Helm chart utility, but the documented commands also interact with live clusters and repositories, including listing releases, reading deployed state, and performing rollbacks. This mismatch can mislead users into approving or invoking the skill without understanding that it can affect real environments and external registries.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Commands ### `KUBECONFIG` Path to kubeconfig file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Commands ### `KUBECONFIG` Path to kubeconfig file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ## Commands ### `KUBECONFIG` Path to kubeconfig file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ## Commands ### `KUBECONFIG` Path to kubeconfig file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ## Commands ### `KUBECONFIG` Path to kubeconfig file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ## Commands ### `KUBECONFIG` Path to kubeconfig file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ## Commands ### `KUBECONFIG` Path to kubeconfig file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ## Commands ### `KUBECONFIG` Path to kubeconfig file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
KUBECONFIGPath to kubeconfig file
bash scripts/script.sh KUBECONFIG
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ### `KUBECONFIG` Path to kubeconfig file ```bash scripts/script.sh KUBECONFIG
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ### `KUBECONFIG` Path to kubeconfig file ```bash scripts/script.sh KUBECONFIG
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ### `KUBECONFIG` Path to kubeconfig file ```bash scripts/script.sh KUBECONFIG
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Rollback is a cluster-changing, potentially production-impacting operation that is not justified by the stated purpose of chart scaffolding, linting, templating, or packaging. In this context, the capability is especially dangerous because it can alter live release state and trigger service disruption or rollback to insecure or broken revisions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill exposes shell-backed operational capabilities but does not declare any tool scope such as permissions or allowed-tools. This makes the effective execution surface opaque to users and policy systems, increasing the risk of unintended command execution or broader-than-expected access.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description omits repository-management and cluster-management functions that are materially more sensitive than local chart scaffolding. In security-sensitive environments, incomplete disclosure reduces informed consent and can bypass user expectations or governance controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Several commands can modify local files, Helm repository configuration, or cluster-related state, but the skill does not warn users about these side effects. Lack of warnings is dangerous because users may treat the skill as informational when some operations are administrative or destructive.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script exposes live cluster-management commands such as list, status, history, rollback, and manifest retrieval even though the skill description is focused on chart creation, linting, templating, and packaging. This scope expansion increases operational risk because a user invoking a seemingly chart-focused helper can unexpectedly interact with production clusters and release state.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh echo "" echo " Or via package manager:" echo " macOS: brew install helm" echo " Snap: sudo snap install helm --classic" echo " Chocolatey: choco install kubernetes-helm" echo " apt (Debian): sudo apt-get install helm" echo ""
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh echo "" echo " Or via package manager:" echo " macOS: brew install helm" echo " Snap: sudo snap install helm --classic" echo " Chocolatey: choco install kubernetes-helm" echo " apt (Debian): sudo apt-get install helm" echo ""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The rollback path executes a state-changing Helm rollback immediately after collecting or receiving a revision, but it does not require a final confirmation acknowledging the target cluster and consequences. This makes accidental destructive actions more likely, especially in automation or when the user assumes the helper is primarily read-only/chart-local.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script includes repository mutation and remote search features not declared in the manifest description, which broadens network and configuration side effects beyond what a user would reasonably expect from a chart scaffolding/linting helper. While less severe than rollback, undeclared remote operations still weaken trust boundaries and increase attack surface.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 15% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh _error "helm is not installed or not in PATH." echo "" echo "Install Helm v3:" echo " curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash" echo "" echo " Or via package manager:" echo " macOS: brew install helm"