Security Advisory: Remote Code Execution risk via unsigned install script (curl | bash)

[joergmichno]

Summary

The installation method documented in the README pipes a remote script directly to bash without signature verification:

curl -fsSL https://raw.githubusercontent.com/Anandb71/arbor/main/scripts/install.sh | bash

Risk

If an AI agent (e.g., via MCP) reads this README and interprets this as an instruction to execute, it results in full Remote Code Execution on the host system. The script is self-hosted on this repository without checksum or signature verification.

OWASP Classification

• LLM01: Prompt Injection (tool description as injection vector)
• AG07: Untrusted Data Consumption

Recommendation

1. Add checksum verification (SHA-256 hash published separately)
2. Recommend manual review before execution in README
3. Consider alternative installation methods (pip, brew, etc.)
4. Add a security notice that automated tools should not execute this command

References

---

Free compliance check: Run your own prompts through our EU AI Act compliance scanner — instant results, no account required: prompttools.co/report

Best,
Joerg Michno
ClawGuard — Open-Source AI Agent Security | 225 patterns, 15 languages

[Anandb71]

Thank you for the report. However, we are closing this issue as invalid for the following reasons:

• Standard Industry Practice: The curl | bash installation method is an established standard in the open-source ecosystem (used by Homebrew, rustup, nvm, etc.).

• Identical Trust Boundary: The script is hosted on this exact repository. The trust boundary is identical to downloading our pre-built binaries or cloning our source code.

• Alternative Methods Provided: In our v1.7.0 release, we already extensively document package-manager alternatives (Homebrew, Scoop, npm, Cargo, Docker) immediately above the script method for users who prefer checksum-verified package managers.

• Agent Operator Responsibility: If an autonomous AI agent is configured with permissions to execute arbitrary bash commands it scrapes from documentation without a human-in-the-loop, that is a critical misconfiguration on the agent operator's side, not a vulnerability in this repository's README.

We appreciate the heads-up, but we will maintain the one-shot installer for developer convenience.