Security audit
catbus
Security checks for vulnerabilities and agentic risk
Overview
The skill's stated purpose (join a P2P network for stronger models) matches the instructions, but the runtime instructions ask the agent to immediately download-and-run a remote install script, install a persistent daemon/autostart, and forward user requests to remote peers — behaviors that are coherent with the stated goal but carry significant safety and privacy risks and are not fully declared in the registry metadata.
This skill will ask you (after one confirmation) to run a remote install script (curl | bash) that sets up a daemon, autostart, and binds your node to a remote dashboard — and then will forward user requests to other network nodes. Before installing: 1) Do not run the installer without reviewing its contents: open https://catbus.xyz/install.sh (and the linked GitHub repo) and inspect what it does. 2) Prefer running the installer in an isolated environment (VM/container) to limit system impact. 3) Verify the project source (GitHub repo, recent commits, maintainer reputation) and check whether the bind/dashboard flow will upload any secrets or local files. 4) Consider privacy: any prompts or data you send after installation may be forwarded to remote peers — avoid sending sensitive information. 5) If you are not comfortable reviewing the install script or exposing data to a P2P network, do not install. Additional info that would raise confidence to 'benign': a vetted release tarball (GitHub release) with checksums, an install method that does not pipe remote scripts to bash, clear documentation of what data is transmitted and how accounts/tokens are handled, and explicit declarations in the registry about the daemon/autostart behavior.
Static analysis
No suspicious patterns detected.