Corespeed Excalidraw Rendering

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but its installer runs an unverified remote shell script with the user's privileges.

Review this skill before installing. Its core rendering behavior is understandable, but install brow only through a trusted, pinned, and verifiable source rather than piping a live GitHub script into bash. Use the screenshot feature only for trusted external URLs, not internal services or sensitive local addresses.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:15

Finding

Unverified Remote Installer Is Downloaded and Executed by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15 and 40
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

Line 15, automatic installation metadata:

json

"command": "curl -fsSL https://raw.githubusercontent.com/corespeed-io/brow/main/install.sh | bash",

Line 40, manual installation instructions:

bash

curl -fsSL https://raw.githubusercontent.com/corespeed-io/brow/main/install.sh | bash

Technical Analysis

Both installation paths retrieve install.sh from the mutable main branch of an external GitHub repository and immediately pass the response to Bash. The downloaded content is not pinned to an immutable commit or release, saved for inspection, or validated using a cryptographic signature or checksum.

HTTPS protects the network connection in transit, but it does not make the upstream payload immutable or protect against compromise of the repository, maintainer account, release process, or branch. The code that ultimately executes can therefore change after the Skill has been reviewed without requiring any modification to this project.

Installing a rendering utility may be necessary for the declared functionality, but executing an unverified network response with all of the invoking user's authority exceeds the minimum privilege and trust required. A pinned, reviewed, and integrity-verified artifact would provide the same functionality with less supply-chain risk.

The installer source is not included in the audited project. Consequently, this audit does not establish that the current remote script performs credential theft, persistence, or other malicious actions. The confirmed vulnerability is the unrestricted execution channel delegated to mutable remote content.

Attack Path

1. An attacker compromises the upstream GitHub repository, a maintainer account, the main branch, or another part of the installer publication ...[truncated 1659 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both instances of the curl | bash installation pattern.
2. Pin the dependency to a specific reviewed release or immutable commit rather than the mutable main branch.
3. Download the installer or release artifact to a local file before execution so it can be inspected:

   bash

   curl -fL -o brow-installer.sh "https://example.invalid/pinned/version/install.sh"
   

4. Publish and verify a cryptographic signature or trusted SHA-256 checksum before executing any downloaded content:

   bash

   echo "<EXPECTED_SHA256>  brow-installer.sh" | sha256sum -c -
   

5. Execute the installer only after successful verification, and avoid elevated privileges unless a specific operation demonstrably requires them.
6. Prefer a reputable package manager or signed release package with an explicitly locked version and verifiable provenance.
7. Document the installer's expected network access, files created or modified, executable destination, update behavior, and uninstall procedure.
8. Apply equivalent pinning and integrity verification to the managed browser downloaded by brow browser install, or document the verification guarantees implemented by brow.
9. Run installation and rendering in a sandbox or restricted account with access limited to the required input and output paths.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The '| bash' pattern is especially dangerous because it chains network retrieval directly into execution, eliminating an opportunity to inspect the script before it runs. In a skill context, this can normalize unsafe operator behavior and turn a compromised upstream script into full command execution on the agent host.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

If brow is not installed:

bash

curl -fsSL https://raw.githubusercontent.com/corespeed-io/brow/main/install.sh | bash

Before first render, install the managed browser (safe to re-run):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation tells users to install the tool by piping a remotely fetched script directly into bash without any warning or integrity verification. If the source repository, transport path, or script content is compromised, this results in immediate arbitrary code execution on the host running the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs users to screenshot arbitrary web pages but does not warn that doing so causes the agent or host environment to fetch remote content. That can expose network metadata, trigger access to internal-only URLs if misused, and create SSRF-like risk when users supply untrusted or sensitive targets.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The skill metadata includes an install command that fetches a shell script from GitHub and executes it directly. Because this is part of the skill's automated installation path, it increases the chance that unreviewed remote code will be executed with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

{
              "id": "brow-install",
              "kind": "shell",
              "command": "curl -fsSL https://raw.githubusercontent.com/corespeed-io/brow/main/install.sh | bash",
              "bins": ["brow"],
              "label": "Install brow CLI (https://github.com/corespeed-io/brow)",
            },

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The documented installation command performs remote script execution from a mutable URL, which is a classic software supply-chain risk. Anyone who can alter the hosted script or the referenced branch can cause arbitrary commands to run on systems following the instructions.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

If brow is not installed:

bash

curl -fsSL https://raw.githubusercontent.com/corespeed-io/brow/main/install.sh | bash

Before first render, install the managed browser (safe to re-run):

Static analysis

No suspicious patterns detected.