Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All skills
Skill

boltz-cli-setup

skill:openai/plugins#boltz-cli-setup

Boltz CLI setup and auth. Use when installing, updating, verifying, or authenticating `boltz-api`, or fixing missing CLI, PATH, sandbox, browser login, or auth errors.

SkillsMP
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:18 UTC at 0722921

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

3
findings
critical
highest severity
2
threat classes
5,479
files scanned
25/25
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding skill:plugins/boltz-api-cli/skills/boltz-cli-setup:plugins/boltz-api-cli/skills/boltz-cli-setup/SKILL.md:31:EXEC
  • suspicious: finding skill:plugins/boltz-api-cli/skills/boltz-cli-setup:plugins/boltz-api-cli/skills/boltz-cli-setup/references/sandbox.md:24:EXEC
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:1eb3bc800b13e171)
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:311f2643554fd023)
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:3f753c69d8569f3a)
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:5c88a6e08667b827)
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:6b0ea6559ac66545)
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:8443931fc3d997d9)
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:9339a68db62b5387)
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:aff69290303ea5c7)
  • suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:d90b4243cbb404d0)
  • suspicious: unverified finding skill:plugins/boltz-api-cli/skills/boltz-cli-setup:plugins/boltz-api-cli/skills/boltz-cli-setup/references/sandbox.md:8:PRIVESC

Security findings 3

Code execution

criticalContextual riskhigh confidence

The sandbox reference instructs the agent to run the install.boltz.bio curl|sh installer and device-code login in the user's real environment after confirmation, again executing mutable remote code as the user outside the sandbox.

plugins/boltz-api-cli/skills/boltz-cli-setup/references/sandbox.md:24
curl -fsSL https://install.boltz.bio/boltz-api/install.sh | sh
conceal:remotevector:instruction
Counter-argument considered

Same carve-out as the SKILL.md install flow: the vendor's official installer in a fenced install command serving the declared core capability, run only after explicit confirmation that the user accepts mutable remote code from install.boltz.bio executing outside the sandbox, with pinned verified artifacts preferred first; the risk is declared, not concealed.

Code execution

criticalContextual riskhigh confidence

The skill instructs the agent to install boltz-api by piping a mutable, unpinned remote script from install.boltz.bio into sh (or irm|iex on Windows), executing remote code as the user outside the sandbox with behavior uncontrolled by this pinned commit.

plugins/boltz-api-cli/skills/boltz-cli-setup/SKILL.md:31
curl -fsSL https://install.boltz.bio/boltz-api/install.sh | sh
conceal:remotetrigger:conditionalvector:instruction
Counter-argument considered

The curl|sh line is the vendor's official installer in a fenced install command serving the skill's declared core capability (installing boltz-api), gated by a mandatory exact-command explicit confirmation with pinned checksummed artifacts preferred first, and the mutable-remote-code risk is itself declared in the skill; this is the accepted vendor-installer/declared-core pattern, not concealed or undeclared remote execution.

Open questions 7

What the analysis could not settle from the code alone.

Whether install.boltz.bio is genuinely operated by the vendor of boltz-api; the skill asserts it is 'its official installer', but the artifact contains no verifiable linkage, and an impostor domain would turn the gated install instruction into arbitrary attacker code execution.
Impersonation
What the install.boltz.bio installer scripts actually do at execution time, since their behavior lives outside the pinned commit and cannot be inspected from this artifact.
Code execution
Whether install.boltz.bio is the genuine official vendor domain for boltz-api cannot be verified from the artifact; the text's assertion that it is Boltz's official installer is an unverifiable status claim, so domain impersonation or a look-alike host cannot be ruled out.
Supply chain
What the mutable remote installers install.sh/install.ps1 at install.boltz.bio actually do at execution time cannot be determined from the pinned commit, so the full source-to-sink chain of the instructed fetch-and-execute remains open.
Code execution
What do the remote scripts at https://install.boltz.bio/boltz-api/install.sh and install.ps1 actually do, and is install.boltz.bio the authoritative Boltz vendor domain? Their behavior lives outside the pinned commit and cannot be verified from the shown content.
Code execution
Does the version-pinned release artifact with verifiable checksum or signature that the skill prefers actually exist and get used, or is the mutable curl|sh installer the only real install path in practice?
Code execution
Detector lead PY-CLAIM-CONTRADICTION suggests the BOLTZ_API_KEY check conflicts with the no-print rule, but the command only echoes the literal status string 'BOLTZ_API_KEY is configured' and never the key value; confirm no other shown or hidden code prints or transmits the variable's value.
Credential access
Refuted findings 5

Candidates the review stage examined and rejected, kept for transparency.

Privilege escalation

highRefutedlow confidence

The skill instructs the agent to request host sandbox bypass/escalation so the remote installer can run as the user outside the sandbox, extending agent authority beyond the sandbox on the strength of a one-time confirmation.

plugins/boltz-api-cli/skills/boltz-cli-setup/SKILL.md:43
Request the host sandbox bypass/escalation
Why it was refuted

The bypass request is explicitly conditioned on the installer's exact-command explicit confirmation, and the skill forbids treating a general setup request as authorization; the escalation is openly declared, host-mediated, and scoped, so no authority extension beyond confirmed user consent exists as claimed.

Agent hijacking

highRefutedmedium confidence

The skill instructs the agent to start device-code authentication login on the user's behalf without asking permission, skipping user confirmation for an auth flow that the same section pairs with browser auto-open and sandbox bypass requests.

plugins/boltz-api-cli/skills/boltz-cli-setup/SKILL.md:64
Do not ask the user for permission before starting device-code login
Why it was refuted

Device-code login is the skill's declared core capability (authenticating boltz-api), the no-prompt instruction is stated openly with its rationale, and the user stays in control: the agent only starts the CLI and relays the URL/code while the CLI waits for the user to complete authentication, so no auth is taken over without consent.

Privilege escalation

highRefutedmedium confidence

The skill instructs the agent to start boltz-api auth login --device-code without asking the user for permission and, in sandboxed environments, to request host sandbox bypass/escalation for browser auto-open, OAuth callbacks, credential storage, and temp files, removing a user-confirmation gate inside the declared auth-recovery flow.

plugins/boltz-api-cli/skills/boltz-cli-setup/SKILL.md:64
Do not ask the user for permission before starting device-code login
Why it was refuted

The auth-recovery bypass request is openly declared in the skill, narrowly scoped to specific auth needs, mediated by host approval and minimization guidance, and serves the declared browser-login/auth-recovery capability while the user still completes login interactively; the claimed removal of a confirmation gate is not an undeclared privilege escalation.

Privilege escalation

highRefutedlow confidence

For auth recovery the skill instructs the agent to assume the CLI can auto-open the browser and to request host sandbox bypass/escalation for OAuth callbacks, credential storage, and temp files without a per-command confirmation gate.

plugins/boltz-api-cli/skills/boltz-cli-setup/SKILL.md:66
request the host sandbox bypass/escalation needed for browser auto-open
Why it was refuted

The bypass request for browser auto-open, OAuth callbacks, credential storage, and temp files is openly declared, strictly scoped to the confirmed auth flow, and remains a host-mediated permission request rather than a self-granted escalation, so the claimed ungated privilege extension does not hold.

Supply chain

highRefutedlow confidence

The skill directs the agent to treat the CLI's remote version endpoint as the source of truth and relay, and per the install flow run, whatever install command that mutable remote endpoint provides at runtime.

plugins/boltz-api-cli/skills/boltz-cli-setup/SKILL.md:83
relay that message and the install command it provides
Why it was refuted

The text instructs the agent only to relay the CLI's update message and suggested command to the user, not to run it, and any installer execution still passes through the skill's mandatory exact-command explicit-confirmation gate, so the claimed runtime remote-command-to-execution chain does not exist; the update-check alignment is openly declared and respects opt-outs.

Coverage gaps 15

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/helpers.mjs.br.part-000
context:unanalyzable_binary macho content is only byte-scanned
plugins/codex-security/mcp/native/darwin-arm64/unix.node
context:unanalyzable_binary macho content is only byte-scanned
plugins/codex-security/mcp/native/darwin-x64/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-arm64-gnu/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-arm64-musl/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-x64-gnu/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-x64-musl/unix.node
context:unanalyzable_binary pe content is only byte-scanned
plugins/codex-security/mcp/native/win32-arm64/windows.node
context:unanalyzable_binary pe content is only byte-scanned
plugins/codex-security/mcp/native/win32-x64/windows.node
context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/server.mjs.br.part-000
context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/server.mjs.br.part-001
context:oversize archive member exceeds 8388608 bytes; truncated, no text
plugins/shopify/skills/shopify-admin/assets/admin_2026-04.json.gz!/admin_2026-04.json
context:decoded_views_exceeded 452 derived view(s) beyond the per-file view cap: decoded:charcode, decoded:rot13, decoded:unicode-escape
plugins/creative-production/mcp/server.bundle.mjs
context:bytes_unavailable yara-x: no bytes to scan
plugins/shopify/skills/shopify-admin/assets/admin_2026-04.json.gz!/admin_2026-04.json
invalid_refuter refuter results do not match requested findings