Skill Trust Decision
memphis-cognitive
Documentation-only skill that prominently instructs users to execute remote curl|bash installers without adequate warnings, enabling supply chain attack vectors through untrusted external scripts.
Most direct threat evidence
Critical Supply Chain
Remote script execution via curl|bash SKILL.md, QUICKSTART.md, and README.md instruct users to execute remote shell scripts directly from GitHub raw URLs without verification. This is a primary supply chain attack vector.
QUICKSTART.md:13 Why this conclusion was reached
2/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
2 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
User follows skill documentation
initial_access · QUICKSTART.md:13
02
Executes curl|bash from unverified GitHub raw URL
delivery · QUICKSTART.md:13
03
install.sh runs arbitrary code with user/root privileges
Execution · https://raw.githubusercontent.com/elathoxu-crypto/memphis/main/install.sh:1
04
Malicious code in install.sh could: install backdoor, exfiltrate credentials, establish persistence
Impact · external
What drove the risk score up
Remote curl|bash execution in documentation +35
QUICKSTART.md:13 and README.md:128 instruct users to pipe remote scripts directly to bash/shell
No declared permissions vs undeclared shell execution vectors +15
Skill declares NONE permissions but guides users to execute arbitrary remote code
Opaque third-party dependency +10
Actual functionality lives in externally-installed Memphis CLI from unverified GitHub repo elathoxu-crypto/memphis
Known risk disclosure in skill-card.md +-10
Risk acknowledged in skill-card.md but not prominently surfaced in SKILL.md itself
Most important evidence
Critical Supply Chain
Remote script execution via curl|bash
SKILL.md, QUICKSTART.md, and README.md instruct users to execute remote shell scripts directly from GitHub raw URLs without verification. This is a primary supply chain attack vector.
QUICKSTART.md:13 Remove curl|bash one-liner. Use manual installation steps with version-pinned releases or require users to inspect scripts before execution.
Critical Supply Chain
Second remote script execution via curl|sh
README.md instructs users to install Ollama via curl|sh remote script, compounding supply chain risk.
README.md:128 Remove curl|sh for Ollama. Point to official package manager instructions or require manual inspection.
Medium Doc Mismatch
Security risks not prominently surfaced in SKILL.md
skill-card.md contains explicit risk disclosures about privileged shell installers and sensitive data handling, but SKILL.md—the primary documentation users interact with—does not prominently warn about these dangers.
SKILL.md:1 Add prominent security section at top of SKILL.md warning about remote script risks and data sensitivity.
Low Priv Escalation
Potential privilege escalation through npm install -g
Installation instructions suggest npm install -g which may require sudo privileges, executing with elevated permissions.
README.md:62 Document that global npm installs may require privilege escalation and advise caution.
Declared capability vs actual capability
Filesystem Pass
Declared NONE
→ Inferred NONE
No file writes in skill files; wrapper only checks CLI presence Shell Pass
Declared NONE
→ Inferred NONE
Wrapper uses exec memphis $@ only; no direct shell execution in skill Network Pass
Declared NONE
→ Inferred NONE
Skill files do not make network requests credential Pass
Declared NONE
→ Inferred NONE
No credential access in skill code Environment Pass
Declared NONE
→ Inferred NONE
No env access in skill files Suspicious artifacts and egress
Critical Dangerous Command
curl -fsSL https://raw.githubusercontent.com/elathoxu-crypto/memphis/main/install.sh | bash QUICKSTART.md:13
Critical Dangerous Command
curl -fsSL https://ollama.com/install.sh | sh README.md:128
Medium External URL
https://deb.nodesource.com/setup_20.x README.md:90
Medium External URL
https://ollama.com/install.sh README.md:128
Medium External URL
https://clawhub.com/skill/memphis-cognitive README.md:268
Medium External URL
https://discord.gg/clawd README.md:269
Medium External URL
https://clawhub.ai/user/elathoxu-crypto skill-card.md:7
Medium External URL
https://clawhub.ai/elathoxu-crypto/memphis-cognitive skill-card.md:27
Dependencies and supply chain
There are no structured dependency warnings.
File composition
6 files · 983 lines
Markdown 4 files · 961 linesShell 1 files · 17 linesJSON 1 files · 5 lines
Files of concern · 4
SKILL.md Security risks not prominently surfaced in SKILL.md
README.md Second remote script execution via curl|sh · Potential privilege escalation through npm install -g · curl -fsSL https://ollama.com/install.sh | sh · https://deb.nodesource.com/setup_20.x · https://ollama.com/install.sh · https://clawhub.com/skill/memphis-cognitive · https://discord.gg/clawd
skill-card.md https://clawhub.ai/user/elathoxu-crypto · https://clawhub.ai/elathoxu-crypto/memphis-cognitive
QUICKSTART.md Remote script execution via curl|bash · curl -fsSL https://raw.githubusercontent.com/elathoxu-crypto/memphis/main/install.sh | bash
Other files · memphis-wrapper.sh · _meta.json
Security positives
Skill is explicitly documented as documentation-only (META-PACKAGE), no hidden compiled code
Wrapper script (memphis-wrapper.sh) is simple and benign - only checks CLI presence and forwards args
skill-card.md acknowledges supply chain risks and advises users to review scripts before execution
No credential theft, data exfiltration, or obfuscation observed in skill files themselves
No base64-encoded execution, reverse shells, or C2 communications in skill code
MIT license, open source repository declared
Local-first architecture (no mandatory cloud dependency for core functions)