briefing

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:25 AM UTC
• Version: 1.0.9

Overview

This skill performs a plausible video-briefing function, but its automatic installer downloads and executes mutable remote code while making privileged and persistent system changes without clear user control.

Install only if you are comfortable with a first-run setup that can run shell commands, request sudo, change system packages, download current code from GitHub, install Python packages, create a persistent launcher, and edit shell startup files. Prefer reviewing or pinning the remote repository and dependencies, running installation manually, and using a user-local install path before enabling this skill.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:100

Finding

Automatic Retrieval and Execution of Mutable Remote Code

Content

View full analysis

/dev/null || true)" ]; then echo "INSTALL_DIR exists and is not a git repo: $INSTALL_DIR" echo "Use an empty directory or pass INSTALL_DIR=/path/to/dir" exit 1 fi log "Cloning repo to $INSTALL_DIR" git clone "$REPO_URL" "$INSTALL_DIR" fi } setup_python_env() { log "Creating virtual environment" "$PYTHON_BIN" -m venv "$VENV_DIR" log "Installing Python dependencies" "$VENV_DIR/bin/pip" install -U pip setuptools wheel "$VENV_DIR/bin/pip" install -r "$INSTALL_DIR/requirements.txt" } ``` ```bash verify_install() { "$VENV_DIR/bin/python" -c "import sys; sys.path.insert(0, '$INSTALL_DIR'); import main" >/dev/null ``` ### Technical Analysis The skill instructions direct the agent to execute `install.sh` automatically whenever the `briefing` command is unavailable. The installer then clones or updates a mutable Git repository without pinning a commit, tag, or verified content digest. The resulting remote source is trusted immediately. Its dependency manifest is passed to `pip`, and its `main.py` module is explicitly imported. Python imports execute module-level statements, so the verification step is itself a direct execution sink for remotely retr ...[truncated 1629 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: install.sh:117

Finding

Installation of Unreviewed and Unpinned Remote Python Dependencies

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: install.sh:23

Finding

Automatic Elevated and Persistent System Modification

Content

View full analysis

> "$target" log "Added PATH entry to $target" } ``` ### Technical Analysis The installer requests administrative privileges to modify system package state and, where necessary, write the `briefing` launcher to `/usr/local/bin`. It also permanently modifies a user shell startup file to prepend the launcher directory to `PATH`. These operations occur as part of the automatic bootstrap workflow described in `SKILL.md`, rather than through a separately confirmed administrative installation ...[truncated 1759 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest describes a content-tracking/transcription skill, but the observed behavior includes broad installation and persistence actions such as package management, cloning code, creating environments, writing launchers, and modifying shell startup files. That mismatch is dangerous because it hides privileged system changes behind a benign-looking description, increasing the chance a user consents without understanding the real risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill clearly authorizes shell-based execution (bash {skillDir}/install.sh and running the briefing binary), but the manifest does not declare any corresponding tool scope or permission boundaries. This creates a transparency and least-privilege problem: operators may invoke a skill with execution capabilities that are not explicitly disclosed in metadata.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions tell the agent to automatically execute an installer shell script if the binary is missing, which expands the skill from using a CLI to running arbitrary code from the skill directory. In this context, installer execution is especially risky because shell scripts can perform unrestricted system modifications, fetch remote code, or establish persistence unrelated to video transcription.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to run an install script automatically, without any prompt, warning, or confirmation to the user. Silent installation is dangerous because it can trigger package installs, PATH changes, repository cloning, or other persistent system modifications without informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest presents the skill as a briefing pipeline for tracking creator channels and transcribing videos, but the documentation mandates using bash/exec to run commands. While invoking the bundled CLI may be implementation-related, requiring unrestricted shell execution is a broader capability than the stated purpose itself justifies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs privileged package installation and later system-level launcher installation via sudo, but it does not present an upfront warning that elevated privileges and system modifications will be requested. This is risky because users may run the installer without understanding it will change system packages and write into shared binary locations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Running sudo apt-get update triggers privileged system package metadata updates as part of the installer workflow. In context this is expected installer behavior, but it is still security-relevant because it executes with elevated privileges and expands the blast radius if the script or its environment is tampered with.

Content

Scanner excerpt · install.sh (reported line 31)May include surrounding context.

sh

fi

  if require_cmd apt-get; then
    sudo apt-get update
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo apt-get install -y git curl python3.12 python3.12-venv ffmpeg
    else

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · install.sh (reported line 33)May include surrounding context.

sh

if require_cmd apt-get; then
    sudo apt-get update
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo apt-get install -y git curl python3.12 python3.12-venv ffmpeg
    else
      sudo apt-get install -y git curl python3.12 python3.12-venv
    fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This line installs system packages with sudo, giving the installer root-level ability to change host software state. Even though the packages are ordinary dependencies, automatic privileged installation from a third-party script increases risk if the script is modified or run in an unexpected environment.

Content

Scanner excerpt · install.sh (reported line 33)May include surrounding context.

sh

if require_cmd apt-get; then
    sudo apt-get update
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo apt-get install -y git curl python3.12 python3.12-venv ffmpeg
    else
      sudo apt-get install -y git curl python3.12 python3.12-venv
    fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This is another privileged apt-get install path that executes as root without a separate warning at the point of use. The main danger is not the specific packages but the pattern of a network-capable installer making root-level system changes automatically.

Content

Scanner excerpt · install.sh (reported line 35)May include surrounding context.

sh

if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo apt-get install -y git curl python3.12 python3.12-venv ffmpeg
    else
      sudo apt-get install -y git curl python3.12 python3.12-venv
    fi
    if ! require_cmd "$PYTHON_BIN"; then
      echo "python3.12 not found after install. Please install Python 3.12 manually."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The installer uses sudo dnf install for dependencies, which is standard but still a privileged operation from third-party code. This can materially affect the system if the script, package sources, or environment are compromised.

Content

Scanner excerpt · install.sh (reported line 46)May include surrounding context.

sh

if require_cmd dnf; then
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo dnf install -y git curl python3.12 ffmpeg
    else
      sudo dnf install -y git curl python3.12
    fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This alternate dnf branch performs root-level package installation automatically. The security concern is the elevation itself and the trust placed in an external installer to modify system state, not evidence of overtly malicious behavior.

Content

Scanner excerpt · install.sh (reported line 48)May include surrounding context.

sh

if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo dnf install -y git curl python3.12 ffmpeg
    else
      sudo dnf install -y git curl python3.12
    fi
    if ! require_cmd "$PYTHON_BIN"; then
      echo "python3.12 not found after install. Please install Python 3.12 manually."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The yum-based dependency installation path also performs privileged package changes under sudo. This is expected in cross-platform installers, but it remains a true security concern because the script is not just configuring the application; it is modifying the host as root.

Content

Scanner excerpt · install.sh (reported line 59)May include surrounding context.

sh

if require_cmd yum; then
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo yum install -y git curl python3.12 ffmpeg
    else
      sudo yum install -y git curl python3.12
    fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This is the alternate yum install path with the same root-execution risk profile. If a user runs the installer casually, this line gives it authority to alter system packages without granular review.

Content

Scanner excerpt · install.sh (reported line 61)May include surrounding context.

sh

if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo yum install -y git curl python3.12 ffmpeg
    else
      sudo yum install -y git curl python3.12
    fi
    if ! require_cmd "$PYTHON_BIN"; then
      echo "python3.12 not found after install. Please install Python 3.12 manually."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Creating the target binary directory with sudo enables the installer to write into a system-wide executable path. This increases risk because the script is installing a command that all users may later execute, and any compromise in the repository or install path would gain broad reach.

Content

Scanner excerpt · install.sh (reported line 152)May include surrounding context.

sh

fi

  if require_cmd sudo; then
    sudo mkdir -p "$target_dir"
    sudo install -m 0755 "$tmpfile" "$target_path"
    rm -f "$tmpfile"
    LAUNCHER_PATH="$target_path"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Using sudo install to place an executable launcher into a system binary directory is a privileged persistence mechanism, even if intended for convenience. In combination with cloning code from a remote repository, it creates a trusted command entry point that could be abused if upstream content changes or installation variables are manipulated.

Content

Scanner excerpt · install.sh (reported line 153)May include surrounding context.

sh

if require_cmd sudo; then
    sudo mkdir -p "$target_dir"
    sudo install -m 0755 "$tmpfile" "$target_path"
    rm -f "$tmpfile"
    LAUNCHER_PATH="$target_path"
    return

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installer persistently modifies the user's shell startup files to prepend a PATH entry without any explicit opt-in or warning before doing so. While common in installers, this creates a lasting environment change that can affect future command resolution and may surprise users or enable unintended execution precedence if the target directory later contains other binaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

briefing -delete <source_url> removes a tracked source, which is a destructive configuration change. The markdown lists the command but does not warn that it deletes tracking state or suggest confirmation before performing the action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.