netbird-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill documentation shows and encourages passing setup keys, passwords, and PINs directly on the command line (including literal example values), which requires embedding secret values verbatim into commands and creates an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL https://pkgs.netbird.io/install.sh is a direct shell installer that the docs pipe into sudo bash (curl | sudo bash), a high-risk distribution pattern that can deliver arbitrary malware; the other two URLs are normal API/app endpoints on the vendor domain and are not themselves direct download endpoints.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README includes a runtime installation command that pipes a remote script to bash—curl -fsSL https://pkgs.netbird.io/install.sh | sudo bash—which fetches and executes remote code from https://pkgs.netbird.io/install.sh.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running a remote install script with sudo and includes service installation/management commands that modify system services and system files, which require elevated privileges and can change the machine state.