100Critical
The skill forces insecure remote script execution, uses over-broad triggers to hijack agent control, and lacks necessary tool constraints, creating significant risks for arbitrary code execution and data exfiltration.
Skill Info
NameEximAgent/cli/eximagent
Registrygithub
Versione3c7e3e602d6
PURLpkg:github/EximAgent/cli@e3c7e3e602d6?skill=eximagent
Stars2
Source
SHA-256d06133f902e6...
SHA-10d985dbd4920...
MD50a088e4c8ac4...
TLSH4c9309976ba8...
ssdeep1536:+4nXRIj...
Size95,852 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
Skills.shDocs
npx skills add https://github.com/EximAgent/cliAssessments (5)
AI Agent Traps ↗Indirect prompt injection via installercriticalindirect prompt injection
The installation instructions direct users to pipe remote scripts directly into a shell interpreter, which is a classic vector for indirect prompt injection and arbitrary code execution. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
100% confidenceline 15
curl -fsSL https://cli.eximagent.ai/install | sh
Remote code download and execution detectedcriticalremote execAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025
Remote code download and execution detected
95% confidenceline 15
curl -fsSL https://cli.eximagent.ai/install | sh
A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.criticalvulnAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025
A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.
95% confidenceline 1
curl -fsSL https://cli.eximagent.ai/install | sh
Tool shadowing of agent capabilitieshightool shadowing
The instructions explicitly command the agent to ignore local file system search tools and instead use the skill's own commands, effectively isolating the agent's reasoning from the local environment. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
90% confidence
NEVER search local files... Call the command directly: `collection list` / `corridor list`
Location detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected location in skill content (confidence: 0.62)
62% confidence
U*
Location detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected location in skill content (confidence: 1.00)
100% confidence
G******
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 0.58)
58% confidence
m****
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 0.71)
71% confidence
O***
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 0.56)
56% confidenceline 252
N**
Capability inflation hijacking unrelated agent tasksmediumsocial engineeringAML.T0052.000LLM09:2025
The description and intent-map contain an extremely broad trigger list designed to capture nearly any export/import/trade mention, including vague phrases like 'any export/import/international-trade task'. This over-broad activation scope is designed to hijack agent control for tasks that could be handled by built-in tools, routing them through the eximagent CLI and its external service instead. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
75% confidenceline 3
"Use whenever the user mentions eximagent/this CLI/the trade CLI, or asks: find buyers / importers / distributors, look up tariffs, what HS code, sanctions check, draft cold outreach, tell me about this company website, enrich N companies, crawl these websites, show/list/manage saved collections or corridors or templates or knowledge base, trade prospect lists, or any export/import/international-trade task."
Oversight evasion via forced narrationlowoversight evasionAML.T0054LLM01:2025LLM07:2025
The skill mandates specific 'narration moments' for the agent, which can be used to create a false sense of transparency while masking the actual complexity or malicious nature of the underlying tool calls.
60% confidenceline 279
You MUST emit five narration moments. These are non-negotiable — silent multi-step runs violate the platform contract.
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (9)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/EximAgent/cli/eximagent)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/EximAgent/cli/eximagent"><img src="https://mondoo.com/ai-agent-security/api/badge/github/EximAgent/cli/eximagent.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/EximAgent/cli/eximagent.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow