Its AI check confirmed something serious. Don’t install it without reading what it found.
External Script Fetching (high, rule SC2)
skills/ci-security-scanning-with-strix/SKILL.md:44
The workflow pipes a remote script from strix.ai directly into bash with no version pin, checksum, or signature check. If that host or its install script is compromised, the attacker gets code execution on the CI runner, which holds repository contents and the LLM secrets used later in the job.
External Script Fetching (high, rule SC2)
skills/ci-security-scanning-with-strix/SKILL.md:91
The generic 'Any pipeline' example repeats the unverified curl-to-bash install. Users who copy it into CI inherit the same supply-chain exposure, and the example is more likely to be reused without the checksum step.
External Script Fetching (high, rule SC2)
skills/ci-security-scanning-with-strix/SKILL.md:128
In the managed-platform example, the curl-to-bash install runs in the same step that sets STRIX_API_TOKEN in the environment. Any compromise of the remote script can read the token, which grants pr_reviews and scan access on the Strix account, and the step runs on untrusted pull request triggers.
External Script Fetching (high, rule SC2)
skills/managed-pentesting-with-strix/SKILL.md:16
The skill tells the reader to install the CLI with `curl -sSL https://strix.ai/install | bash`. This runs a remote script as the current user with no checksum, signature, or version pin. If the host or the script were compromised, arbitrary code would run on the machine that holds the platform token. The domain matches the vendor's homepage, so intent appears benign, but the pattern is still an unverified remote execution risk, and an agent running it unattended raises the stakes.
External Script Fetching (high, rule SC2)
skills/penetration-testing-with-strix/SKILL.md:46
curl | bash runs a remote script directly with no checksum or signature check. If the domain is compromised or the response is tampered with in transit, arbitrary code runs on the user's machine with their privileges. The vendor appears legitimate, which lowers the likelihood, but the pattern is still unverified remote execution.
Finding (high, rule SQP-2)
skills/find-security-vulnerabilities-in-code/SKILL.md:36
The skill tells users to point Strix at a running instance of their app so the agents can confirm exploits against live behavior. Those exploits are real attack requests and can modify or delete records, so pointing the tool at a production, shared, or unauthorized target can cause data loss or service disruption. The section warns about the writable source mount but says nothing about this live-target risk, nor about needing authorization or a disposable staging environment.
Finding (medium, rule SQP-2)
skills/web-app-penetration-testing/SKILL.md:36
The example puts test-account credentials in plaintext inside a --instruction argument. That exposes them to shell history and process listings, sends them to the external LLM provider, and can persist them in strix_runs artifacts and reports. If those artifacts are committed or shared, the credentials leak.
Finding (medium, rule SQP-2)
skills/penetration-testing-with-strix/SKILL.md:150
strix cloud scans start --source . uploads the whole working tree to a third-party service. That can include .env files, private keys, credentials and other secrets that have nothing to do with the test. The skill gives no warning and no exclusion guidance.
SkillSpector’s own score is 78/100 from 30 findings; only the ones its AI check confirmed count here.
