botpress-adk

clawhub:botpress-adk

View source
C
62/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

41

Score

62/100

HIGH 2
MEDIUM 1
LOW 38

Findings (41)

HIGH
Download-and-execute
L87

Detects patterns of downloading and piping to shell execution

curl -fsSL https://github.com/botpress/adk/releases/latest/download/install.sh | bash
FIX

Download the file first, verify its integrity (checksum, signature), inspect it, then run it. Prefer package managers over raw downloads. Never fetch-and-run in one step.

FP?

Likely FP if the target is a well-known installer (e.g., rustup, Homebrew) from its canonical HTTPS domain, though the pattern is inherently risky.

HIGH
Curl or wget piped to shell
L87

Detects downloading scripts piped directly to a shell interpreter

curl -fsSL https://github.com/botpress/adk/releases/latest/download/install.sh | bash
FIX

Download the script first, inspect it, verify its checksum, then run it. Do not pipe curl/wget output directly to sh/bash. Prefer package manager installs.

FP?

Likely FP if the download is from a well-known installer domain (e.g., brew.sh, rustup.rs), though this pattern is inherently risky even with trusted sources.

MEDIUM
Autonomous agent spawning
L197

Detects autonomous sub-agent or cron-based execution without human oversight

Background process + autonomous
FIX

Remove directives that force the agent to call specific tools or APIs not required for the skill's stated functionality. Tool calls should be determined by user intent, not embedded directives.

FP?

Likely FP if the skill legitimately needs to call other tools as part of its workflow (e.g., a deployment skill that calls git and cloud CLI tools).

LOW
Chained shell command execution
L87

Detects chained commands using shell operators with dangerous operations

curl -fsSL https://github.com/botpress/adk/releases/latest/download/install.sh | bash
FIX

Break chained commands into discrete, individually validated steps. Avoid piping untrusted output directly into a shell interpreter.

FP?

Likely FP if the matched text is a documentation example showing a common installer one-liner for a well-known tool with a canonical URL.

LOW
Mutable GitHub raw content reference
L103

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L125

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L179

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L216

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L285

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
External API response used without validation
L295

Detects patterns where external API responses are used directly without validation or sanitization

API or data + automatically (use
FIX

Validate and sanitize all data received from external APIs before using it in tool operations or agent prompts. Implement schema validation and treat API responses as untrusted input.

FP?

Likely FP if the match is a truncated table cell or documentation fragment that mentions API responses in a descriptive context, not actual unvalidated data processing.

LOW
Mutable GitHub raw content reference
L342

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L421

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L517

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L634

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L740

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L817

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L891

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L994

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1092

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1153

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1206

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1237

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1285

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1522

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1523

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1524

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1525

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1526

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1527

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1528

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1529

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1530

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1531

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1532

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1533

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1534

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1535

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1536

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1537

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1538

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Mutable GitHub raw content reference
L1539

Detects references to raw.githubusercontent.com on mutable branches like main/master

raw.githubusercontent.com/botpress/skills/master/
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.