First Seen
Feb 18, 2026
Last Scanned
Feb 22, 2026
Findings
5
Score
69/100
Findings (5)
Detects downloading scripts piped directly to a shell interpreter
curl http://localhost:3000/health
```
### "Invalid API key"
```bash
# Verify key is set
echo $SF_API_KEY
# Create new key if needed
bun run /opt/kleo-static-files/scripts/create-key.ts "new-key"
```...Download the script first, inspect it, verify its checksum, then run it. Do not pipe curl/wget output directly to sh/bash. Prefer package manager installs.
Likely FP if the download is from a well-known installer domain (e.g., brew.sh, rustup.rs), though this pattern is inherently risky even with trusted sources.
Detects privilege escalation patterns like setuid, chown root, or sudo with shell commands
sudo bashAvoid depending on packages that could be subject to typosquatting or name confusion. Verify package ownership, check download counts, and audit the package source before adding dependencies.
Likely FP if the flagged package is a well-known, high-download-count package from a verified publisher.
Detects skills fetching external URLs to use as runtime instructions
curl -fsSL https://raw.githubusercontent.com + CommandsPin the downloaded resource to a specific version or commit hash, and verify its integrity with a checksum (SHA-256). Avoid fetching scripts or binaries from arbitrary URLs at runtime.
Likely FP if the download URL points to a well-known CDN or package registry (e.g., npmjs.com, pypi.org) and is pinned to a specific version.
Detects chained commands using shell operators with dangerous operations
curl http://localhost:3000/health
```
### "Invalid API key"
```bash
# Verify key is set
echo $SF_API_KEY
# Create new key if needed
bun run /opt/kleo-static-files/scripts/create-key.ts "new-key"
```...Break chained commands into discrete, individually validated steps. Avoid piping untrusted output directly into a shell interpreter.
Likely FP if the matched text is a documentation example showing a common installer one-liner for a well-known tool with a canonical URL.
Detects references to raw.githubusercontent.com on mutable branches like main/master
raw.githubusercontent.com/498AS/kleo-static-files/main/Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.
Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.