eximagent

Remote code download and execution detected

curl -fsSL https://cli.eximagent.ai/install | sh

A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.

curl -fsSL https://cli.eximagent.ai/install | sh

The installation instructions use `curl | sh` and `irm | iex`, which are dangerous patterns that execute remote code with full user privileges without integrity verification.

curl -fsSL https://cli.eximagent.ai/install | sh

NER model detected location in skill content (confidence: 0.62)

U*

NER model detected location in skill content (confidence: 1.00)

G******

NER model detected organization in skill content (confidence: 0.58)

m****

NER model detected organization in skill content (confidence: 0.71)

O***

The documentation explicitly instructs users to bypass sandbox network restrictions to allow the CLI to function, potentially exposing the host environment to unauthorized egress. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]

codex --dangerously-bypass-approvals-and-sandbox

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.