Security audit

ZettaBrain RAG

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real local document-chat integration, but its install instructions ask users to run remote or unpinned code with elevated privileges and create an auto-starting service.

Review the installer source and prefer a pinned, verifiable package or downloaded installer with checksum/signature verification. Install only if you are comfortable granting setup elevated privileges, creating an auto-starting local service, and indexing the selected document sources. Keep OLLAMA_HOST local if document queries must stay on-device, and verify what folders, network shares, or S3 sources are configured before ingesting documents.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:47
Finding: Unverified Remote Installer Is Executed Directly by a Shell
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 47-56
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code

bash
# Linux — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | sudo bash # macOS — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | bash # Windows — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.ps1 irm https://zettabrain.app/install.ps1 | iex

Technical Analysis

These commands retrieve mutable content from zettabrain.app and immediately pass it to Bash or PowerShell. There is no version pinning, cryptographic checksum, signature verification, or opportunity to inspect the exact downloaded artifact before execution.

The documentation links to installer source hosted on GitHub, but the executed payload is served from a different origin. Consequently, reviewing the GitHub file does not prove that zettabrain.app will return identical content. Redirects are also followed by curl -L, increasing reliance on the integrity of the entire delivery chain.

The Linux command is especially dangerous because it invokes the downloaded payload through sudo bash, granting arbitrary root-level execution. The macOS and Windows variants execute with all permissions held by the current user.

Attack Path

An attacker compromises the installer hosting account, web server, DNS configuration, deployment process, or another component controlling zettabrain.app.

The attacker replaces the installer response with a malicious shell or PowerShell script.

A user follows the documented one-line installation command.

The response is streamed directly into the interpreter without integrity verification.

On Linux, the malicious payload execu ...[truncated 890 chars]
Remediation: View remediation
Remediation Suggestions

Remove all pipe-to-shell and irm | iex installation instructions.

Distribute versioned, immutable release artifacts through a trusted release channel.

Require users to download the installer to a local file before execution.

Publish SHA-256 or stronger checksums and cryptographic signatures through an independently protected channel.

Verify both the checksum and signature before executing the installer.

Ensure that the reviewed source and downloaded artifact are demonstrably identical.

Avoid executing the entire installer as root. Isolate necessary system changes in a small, separately audited privileged helper.

Prefer the documented pipx installation path for the user-level application.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:41
Finding: Privileged Setup Installs an Automatically Started System Service
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 41-42, 58-70, and 114-147
Vulnerability Type: Excessive privilege and system persistence
Risk Level: High

Vulnerable Code

bash
pipx install zettabrain-rag sudo zettabrain-setup

text
The Linux installer requires `sudo` to install Ollama system-wide and register a systemd service. The macOS installer does not require `sudo` for the package install step.

bash
sudo zettabrain-setup

text
This will: 1. Configure your document storage (local, NFS, SMB, or S3) 2. Install and start Ollama locally 3. Pull the recommended AI model for your hardware 4. Generate a self-signed TLS certificate (stays on-device) 5. Register ZettaBrain as a background service (see Service Management to stop or remove it)

text
ZettaBrain registers a background service so the web GUI auto-starts on boot.

Technical Analysis

The setup entry point from the installed Python package is run wholesale through sudo. It performs application configuration, storage configuration, model installation, certificate generation, and service registration in a root context rather than isolating only the operations that require elevated privileges.

The setup also registers a systemd or launchd service that starts the web GUI automatically at boot. A persistent service may be useful for an explicitly selected always-on server deployment, but it is not required for the declared CLI document-chat and ingestion functions. Enabling persistence by default therefore exceeds the minimum privileges and lifecycle needed for basic Skill functionality.

This behavior is especially risky when combined with the remote installer and unpinned package installation. If either source is compromised, attacker-controlled code can use the privileged setup process to install a durable service.

Attack Path

A malicious or compromised installer, packa ...[truncated 1322 chars]
Remediation: View remediation
Remediation Suggestions

Make background-service installation explicit and opt-in rather than part of the default setup.

Default to manual CLI execution for chat and ingestion.

Prefer user-scoped systemd or launchd services when persistence is requested.

Run application configuration, certificate generation, model selection, and storage selection as an unprivileged user.

Separate necessary operating-system changes into a minimal, audited privileged helper.

Display the complete service definition, executable path, runtime user, network binding, and filesystem permissions before installation.

Run the service under a dedicated unprivileged account with access only to required document and data directories.

Apply service sandboxing, including filesystem restrictions, capability removal, private temporary storage, and network restrictions where supported.

Require affirmative confirmation before enabling start-at-boot behavior.

Document how to install and operate the application without persistence or root privileges.

T08 · Insecure Dependencies

Error

Location: SKILL.md:38
Finding: Unpinned PyPI Package Is Subsequently Executed with Root Privileges
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 38-42
Vulnerability Type: Insecure dependency installation
Risk Level: High

Vulnerable Code

bash
pipx install zettabrain-rag sudo zettabrain-setup

Technical Analysis

The installation command does not pin zettabrain-rag to a specific audited version and does not verify an artifact hash or package signature. It therefore resolves whichever version the package index considers current at installation time, along with dynamically resolved transitive dependencies.

The installed zettabrain-setup entry point is then run using sudo. This turns compromise of the package, its publishing account, its build pipeline, or a resolved dependency into a potential root-code-execution path.

The package name is consistent with the declared project, and the audited file contains no evidence of typosquatting or dependency confusion. The confirmed weakness is the lack of version and integrity controls before privileged execution.

Attack Path

An attacker compromises the PyPI publisher account, release pipeline, source repository, or a transitive dependency used by the package.

A malicious release is published under the legitimate package name or introduced through dependency resolution.

A user runs the unpinned pipx install zettabrain-rag command.

pipx installs the malicious version or dependency.

The user runs sudo zettabrain-setup as instructed.

Malicious package code executes as root and can modify the host, access protected data, or register a persistent service.

Impact Assessment

Successful exploitation can provide arbitrary root-level execution because the installed package's setup entry point is invoked through sudo. An attacker could compromise the operating system, alter services, read protected configuration, access indexed documents and mounted storage, or establish durable persistence.

Dynamic depe ...[truncated 131 chars]
Remediation: View remediation
Remediation Suggestions

Pin zettabrain-rag to a specific audited version.

Use hashes for the package and all transitive dependencies through a locked requirements or equivalent reproducible environment.

Verify signed release provenance and cryptographic attestations where available.

Use a dependency lock file generated from reviewed artifacts.

Monitor package ownership, release history, and dependency changes.

Avoid invoking the installed application entry point wholesale with sudo.

Move unavoidable privileged operations into a minimal, separately distributed and audited component.

Update pinned versions only through a documented review and integrity-verification process.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This command fetches a remote installer and immediately pipes it into sudo bash, granting any delivered payload full root execution. That creates a single-step supply-chain and remote-code-execution risk with maximum local impact, and the skill context makes it more dangerous because the product is intended to access enterprise documents and run background services.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
bash
# Linux — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | sudo bash # macOS — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | bash

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The dangerous aspect here is not mere command chaining but chaining remote content retrieval directly into privileged shell execution. This removes any inspection boundary and turns a documentation example into a copy-paste root compromise path if the remote script is malicious or altered.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
bash
# Linux — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | sudo bash # macOS — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | bash

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Piping a remote script directly into bash executes network-delivered code without verification or local inspection. Even without sudo, this can fully compromise the user's account, exfiltrate documents, install persistence, or tamper with local AI/storage configuration.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
curl -fsSL https://zettabrain.app/install.sh | sudo bash # macOS — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | bash # Windows — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.ps1 irm https://zettabrain.app/install.ps1 | iex

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping remote content into bash or iex is unsafe chaining because it executes untrusted network data immediately. In this skill's context, the software handles sensitive local documents, so compromising the installer can lead to theft, persistence, and tampering with enterprise data access.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
curl -fsSL https://zettabrain.app/install.sh | sudo bash # macOS — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | bash # Windows — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.ps1 irm https://zettabrain.app/install.ps1 | iex

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
curl -X DELETE http://localhost:7860/api/vectorstore

Or directly

rm -rf /opt/zettabrain/src/zettabrain_vectorstore rm -f /opt/zettabrain/src/ingested_files.json

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
curl -X DELETE http://localhost:7860/api/vectorstore

Or directly

rm -rf /opt/zettabrain/src/zettabrain_vectorstore rm -f /opt/zettabrain/src/ingested_files.json

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
curl -X DELETE http://localhost:7860/api/vectorstore

Or directly

rm -rf /opt/zettabrain/src/zettabrain_vectorstore rm -f /opt/zettabrain/src/ingested_files.json

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
Or directly

rm -rf /opt/zettabrain/src/zettabrain_vectorstore rm -f /opt/zettabrain/src/ingested_files.json

text
**Rebuild from scratch:**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
Remove service completely

sudo systemctl stop zettabrain sudo systemctl disable zettabrain sudo rm /etc/systemd/system/zettabrain.service sudo systemctl daemon-reload

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
sudo launchctl unload /Library/LaunchDaemons/io.zettabrain.server.plist # Remove auto-start on boot sudo rm /Library/LaunchDaemons/io.zettabrain.server.plist # View logs tail -f /opt/zettabrain/logs/server.log

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
md
pipx uninstall zettabrain-rag # Stop and remove service (Linux) sudo systemctl stop zettabrain && sudo systemctl disable zettabrain sudo rm -f /etc/systemd/system/zettabrain.service && sudo systemctl daemon-reload # Stop and remove service (macOS)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
pipx uninstall zettabrain-rag # Stop and remove service (Linux) sudo systemctl stop zettabrain && sudo systemctl disable zettabrain sudo rm -f /etc/systemd/system/zettabrain.service && sudo systemctl daemon-reload # Stop and remove service (macOS)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
# Stop and remove service (Linux) sudo systemctl stop zettabrain && sudo systemctl disable zettabrain sudo rm -f /etc/systemd/system/zettabrain.service && sudo systemctl daemon-reload # Stop and remove service (macOS) sudo launchctl unload /Library/LaunchDaemons/io.zettabrain.server.plist

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
# Stop and remove service (macOS) sudo launchctl unload /Library/LaunchDaemons/io.zettabrain.server.plist sudo rm -f /Library/LaunchDaemons/io.zettabrain.server.plist # Remove all data, config, and vector index sudo rm -rf /opt/zettabrain

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
sudo rm -f /Library/LaunchDaemons/io.zettabrain.server.plist

Remove all data, config, and vector index

sudo rm -rf /opt/zettabrain

text
## Privacy

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
Recommended — pipx (no elevated privileges, fully inspectable)

bash
pipx install zettabrain-rag sudo zettabrain-setup

One-line installer (review source before running)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
Recommended — pipx (no elevated privileges, fully inspectable)

bash
pipx install zettabrain-rag sudo zettabrain-setup

One-line installer (review source before running)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
Recommended — pipx (no elevated privileges, fully inspectable)

bash
pipx install zettabrain-rag sudo zettabrain-setup

One-line installer (review source before running)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
Recommended — pipx (no elevated privileges, fully inspectable)

bash
pipx install zettabrain-rag sudo zettabrain-setup

One-line installer (review source before running)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
Recommended — pipx (no elevated privileges, fully inspectable)

bash
pipx install zettabrain-rag sudo zettabrain-setup

One-line installer (review source before running)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
Recommended — pipx (no elevated privileges, fully inspectable)

bash
pipx install zettabrain-rag sudo zettabrain-setup

One-line installer (review source before running)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
Recommended — pipx (no elevated privileges, fully inspectable)

bash
pipx install zettabrain-rag sudo zettabrain-setup

One-line installer (review source before running)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
Recommended — pipx (no elevated privileges, fully inspectable)

bash
pipx install zettabrain-rag sudo zettabrain-setup

One-line installer (review source before running)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 99% confidence
Finding: Piping a remotely fetched script directly into sudo bash executes unreviewed network content as root, which can lead to full system compromise if the server, CDN, DNS, TLS termination, or distribution path is tampered with. The nearby text says to review first, but the command as written bypasses that safeguard and normalizes unsafe execution.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
bash
# Linux — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | sudo bash # macOS — review first: https://github.com/zettabrain/zettabrain-rag/blob/main/install.sh curl -fsSL https://zettabrain.app/install.sh | bash

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
irm https://zettabrain.app/install.ps1 | iex

text
The Linux installer requires `sudo` to install Ollama system-wide and register a systemd service. The macOS installer does not require `sudo` for the package install step. ## Setup

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SKILL.md:124

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

External Script Fetching

Chaining Abuse

External Script Fetching

Chaining Abuse

Tool Parameter Abuse

Or directly

Tool Parameter Abuse

Or directly

Tool Parameter Abuse

Or directly

Tool Parameter Abuse

Or directly

Tool Parameter Abuse

Remove service completely

Tool Parameter Abuse

Chaining Abuse

Chaining Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Remove all data, config, and vector index

Sudo/Root Execution

Recommended — pipx (no elevated privileges, fully inspectable)

One-line installer (review source before running)

Sudo/Root Execution

Recommended — pipx (no elevated privileges, fully inspectable)

One-line installer (review source before running)

Sudo/Root Execution

Recommended — pipx (no elevated privileges, fully inspectable)

One-line installer (review source before running)

Sudo/Root Execution

Recommended — pipx (no elevated privileges, fully inspectable)

One-line installer (review source before running)

Sudo/Root Execution

Recommended — pipx (no elevated privileges, fully inspectable)

One-line installer (review source before running)

Sudo/Root Execution

Recommended — pipx (no elevated privileges, fully inspectable)

One-line installer (review source before running)

Sudo/Root Execution

Recommended — pipx (no elevated privileges, fully inspectable)

One-line installer (review source before running)

Sudo/Root Execution

Recommended — pipx (no elevated privileges, fully inspectable)

One-line installer (review source before running)

Sudo/Root Execution

Session Persistence

Static analysis

Documentation contains a destructive delete command without an explicit confirmation gate.