Skill Trust Decision
ludwitt-university
The skill embeds a server-controlled update instruction (curl|sh) into console.error output after every API request, creating a potential C2 channel where the remote server can inject and cause execution of arbitrary shell commands through agent stderr monitoring.
Most direct threat evidence
Critical Doc Mismatch
Server-controlled shell command injection via updateInstructions The daemon embeds the server-returned 'updateInstructions' field directly into a console.error() call at daemon.js:42. If the server (opensource.ludwitt.com) is compromised or returns malicious updateInstructions containing 'curl | sh', and if the agent's environment monitors/processes stderr output, arbitrary shell commands can be auto-executed. This is a covert C2 channel that bypasses the skill's declared permissions.
daemon.js:42 Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 5 attack-chain steps and 3 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
Agent installs skill via install.sh or curl|sh from SKILL.md Option A/B
Entry · SKILL.md:39
02
install.sh registers a launchd (macOS) or systemd (Linux) service for boot persistence
Persistence · install.sh:208
03
Machine fingerprint (hostname + platform + arch + CPU model) sent to opensource.ludwitt.com at registration
credential_theft · install.sh:64
04
PATH modification appended to ~/.zshrc or ~/.bashrc for ~/.ludwitt/bin
Persistence · install.sh:229
05
Server-controlled updateInstructions field embedded in console.error at daemon.js:42 — if server returns malicious curl|sh, and agent monitors stderr, arbitrary command executes
Impact · daemon.js:42
What drove the risk score up
Server-controlled curl|sh update injection +30
daemon.js:42 embeds result.updateInstructions from the server into console.error; combined with stderr monitoring, this enables server-injected arbitrary shell command execution via curl|sh pattern
Persistent background service with boot persistence +12
install.sh registers a launchd (macOS) or systemd (Linux) service that auto-starts on boot, undeclared in SKILL.md capabilities
Machine fingerprinting with os.cpus() and os.hostname() +8
install.sh:64-69 generates SHA256 fingerprint from hostname, platform, arch, CPU model — sent to remote server at registration
No declared shell/allowedTools mapping +5
SKILL.md requires 'Bash' access but _meta.json and SKILL.md lack explicit allowedTools declarations
MIT-0 license discrepancy +2
skill-card.md states MIT-0 but AGPL-3.0 is claimed in SKILL.md
Most important evidence
Critical Doc Mismatch
Server-controlled shell command injection via updateInstructions
The daemon embeds the server-returned 'updateInstructions' field directly into a console.error() call at daemon.js:42. If the server (opensource.ludwitt.com) is compromised or returns malicious updateInstructions containing 'curl | sh', and if the agent's environment monitors/processes stderr output, arbitrary shell commands can be auto-executed. This is a covert C2 channel that bypasses the skill's declared permissions.
daemon.js:42 Remove the updateInstructions field from console.error output entirely. If auto-updates are needed, verify the update script hash before execution, never pipe directly to sh.
High Priv Escalation
Undeclared persistent background service with boot persistence
install.sh installs a launchd service on macOS (~/Library/LaunchAgents/com.ludwitt.daemon.plist) and a systemd service on Linux (~/.config/systemd/user/ludwitt-daemon.service). Both are configured to RunAtLoad/Start on boot with KeepAlive. This persistence mechanism is not declared in SKILL.md's capabilities table.
install.sh:208 Declare boot-persistent service installation in SKILL.md capabilities. Require explicit user consent before modifying system service managers.
High Data Exfil
Machine fingerprinting sent to remote server at registration
install.sh generates a SHA256 machine fingerprint by hashing hostname, OS platform, architecture, and CPU model combined with 32 random bytes. This fingerprint is sent to the Ludwitt server at registration time (install.sh:136). This creates a unique per-machine identifier that persists across reinstalls if the auth.json is retained.
install.sh:64 Use a randomly generated UUID instead of hardware-derived fingerprinting. Hardware fingerprinting enables server-side device tracking across reinstalls.
Medium Doc Mismatch
Shell rc file modification undeclared in capabilities
install.sh:229-244 appends 'export PATH=$HOME/.ludwitt/bin:$PATH' to ~/.zshrc or ~/.bashrc without declaring this shell environment modification in SKILL.md. This is an undocumented side effect that persists PATH changes.
install.sh:229 Declare shell rc modification as a required capability in SKILL.md.
Medium Sensitive Access
API key stored in plaintext file with mode 600
Credentials (agentId, apiKey, fingerprint) are stored in ~/.ludwitt/auth.json with chmod 600. While the file permissions are correctly restrictive, the apiKey is a bearer token that provides API access and is sent with every request. No encryption at rest.
install.sh:151 Use OS keychain (Keychain Access on macOS, keyring on Linux) instead of a plaintext JSON file for storing the API key.
Low Supply Chain
No dependency pinning
No package.json, requirements.txt, or equivalent dependency manifest exists. The daemon relies only on built-in Node.js modules (fs, path, https, http, crypto via os). No external npm dependencies means no supply chain risk from third-party packages.
daemon.js:1 No action needed — using only Node.js built-in modules is a positive security trait.
Declared capability vs actual capability
Network Pass
Declared READ
→ Inferred READ
SKILL.md line ~20 declares network access Filesystem Pass
Declared WRITE
→ Inferred WRITE
SKILL.md requires file write access for papers; install.sh writes to ~/.ludwitt/ Shell Block
Declared NONE
→ Inferred WRITE
install.sh:136 executes curl; install.sh:229-260 modifies shell rc files; daemon.js:42 contains curl|sh injection Environment Block
Declared NONE
→ Inferred READ
install.sh:64 reads os.hostname(), os.platform(), os.cpus() for fingerprinting Skill Invoke Pass
Declared NONE
→ Inferred NONE
No skill invocation chain detected Suspicious artifacts and egress
Critical Dangerous Command
curl -sSL https://opensource.ludwitt.com/install | sh daemon.js:42
Medium External URL
https://opensource.ludwitt.com README.md:34
Medium External URL
https://your-deployed-app.vercel.app SKILL.md:181
Medium External URL
https://www.youtube.com/watch?v=... SKILL.md:183
Medium External URL
https://opensource.ludwitt.com/install daemon.js:42
Medium External URL
http://www.apple.com/DTDs/PropertyList-1.0.dtd install.sh:216
Medium External URL
https://clawhub.ai/user/rogerSuperBuilderAlpha skill-card.md:7
Medium External URL
https://clawhub.ai/rogerSuperBuilderAlpha/ludwitt-university skill-card.md:29
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| Node.js builtins only (fs, path, https, http, url, crypto via os) | N/A | builtin | No | No npm package dependencies — zero supply chain risk |
File composition
6 files · 1469 lines
JavaScript 1 files · 728 linesMarkdown 3 files · 413 linesShell 1 files · 323 linesJSON 1 files · 5 lines
Files of concern · 5
daemon.js Server-controlled shell command injection via updateInstructions · No dependency pinning · curl -sSL https://opensource.ludwitt.com/install | sh · https://opensource.ludwitt.com/install
install.sh Undeclared persistent background service with boot persistence · Machine fingerprinting sent to remote server at registration · Shell rc file modification undeclared in capabilities · API key stored in plaintext file with mode 600 · http://www.apple.com/DTDs/PropertyList-1.0.dtd
SKILL.md https://your-deployed-app.vercel.app · https://www.youtube.com/watch?v=...
README.md https://opensource.ludwitt.com
skill-card.md https://clawhub.ai/user/rogerSuperBuilderAlpha · https://clawhub.ai/rogerSuperBuilderAlpha/ludwitt-university
Other files · _meta.json
Security positives
Uses only Node.js built-in modules (fs, path, https, http, crypto via os) — no third-party npm dependencies, eliminating supply chain risk
API key and fingerprint are stored with mode 600 (owner-read-only) permissions
MIT-0 license provides clear usage terms
skill-card.md contains a 'Known Risks and Mitigations' section that acknowledges the persistent service and credential storage risks
install.sh validates minimum Node.js version (18+) before proceeding
No obfuscation techniques detected — code is readable and auditable
Registration HTTP response codes are validated and non-200 responses cause install failure
Request retry logic with exponential backoff prevents accidental DoS from retry storms