External Download

External download vulnerabilities occur when a skill downloads content from the internet and uses it in a potentially dangerous way. The classic pattern is fetching a script from a URL and piping it directly into a shell interpreter without inspection. But the category is broader than that: downloading binaries and executing them, fetching configuration files that override local settings, pulling in JavaScript that runs in an embedded browser, or retrieving serialized objects that execute code on deserialization.

The fundamental problem is trust delegation. When a skill downloads and runs remote code, you are trusting not just the skill author, but every server that code passes through, every CDN edge node, every DNS resolver in the chain. A compromised CDN or a DNS hijack turns a legitimate download into malware delivery.

Aguara detects sixteen patterns in this category, plus the SUPPLY_003 cross-category rule for download-and-execute chains. The detections cover remote script piping, dynamic binary downloads, remote script execution, archive extraction followed by execution, and more.

AI agents amplify external download risks in two ways. First, the agent might download and execute code as part of normal tool use, making it hard for users to distinguish legitimate downloads from malicious ones. When your agent says "I will install this dependency for you," you probably approve it. You should not always.

Second, prompt injection can redirect downloads. A skill might be designed to download from a specific, trusted URL, but an injected instruction changes the URL to point at an attacker server. The skill download code is legitimate. The URL it is downloading from is not. The skill has no way to know the difference because the URL came from the agent, which got it from an injection.

The ephemerality of MCP sessions makes this worse. In a long-lived server, you might notice a suspicious binary that appeared overnight. In an agent session that spins up, does its work, and tears down, the evidence disappears. The downloaded malware runs, does its damage, and the session is gone.

Never pipe downloaded content directly into a shell or interpreter. Always download first, verify integrity (checksums, signatures, or at minimum file size and type), inspect the content if feasible, then execute. This applies to scripts, binaries, configuration files, and serialized data.

Pin your dependencies to specific versions and verify their integrity. If your skill downloads a binary from GitHub Releases, include the expected SHA-256 hash and verify it before execution. If you use a package manager, lock your dependency versions. Avoid fetching "latest" from any URL.

As a user, pay attention when your agent downloads and runs things. If a skill needs to fetch external resources, it should document exactly what it downloads, from where, and why. Undocumented downloads are a strong signal of either poor security practices or malicious intent. Both are reasons not to install the skill.