fix(allium-x402): use HTTPS for CLI install command#80
Open
sricursion wants to merge 1 commit into
Open
Conversation
The skill instructed agents to install the Allium CLI via `curl -sSL http://agents.allium.so/cli/install.sh | sh`. A network adversary on the path (public WiFi, evil-twin AP, compromised router, malicious DNS, BGP hijack) could answer the cleartext request with an arbitrary shell payload that runs as the user — full local code execution, with same-user access to the encrypted wallet store at ~/.config/moonpay/wallets.json and the OS-keychain encryption key. The same host already serves over HTTPS (used elsewhere in the same file for the x402-setup/developer/explorer skill fetches), so this is a single-character oversight on the most security-sensitive line of the skill, not a server limitation. Fix: change http:// to https:// in both the `install:` frontmatter field and the CLI table in the skill body. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR hardens the Allium x402 skill by switching its documented CLI installer from HTTP to HTTPS, which fits the codebase’s goal of providing safe, actionable agent instructions for third-party tools.
Changes:
- Updates the
installfrontmatter command to usehttps://agents.allium.so/.... - Updates the CLI summary table to show the same HTTPS install command.
- Keeps the rest of the skill behavior and fetch flow unchanged.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Author
|
When you have a moment, could you please review this PR? It switches the Allium CLI install command from HTTP to HTTPS to close a MITM risk on the installer path. Thank you. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes the Allium CLI install command in
skills/allium-x402/SKILL.mdfromhttp://tohttps://(two locations: theinstall:frontmatter field on line 8 and the CLI table on line 21).Why
The skill instructed agents to install the Allium CLI by piping cleartext HTTP to
sh:A network adversary on the path (public WiFi, evil-twin AP, compromised home router, malicious DNS resolver, BGP hijack) can answer the cleartext request with an arbitrary shell payload.
shruns that payload as the user — and that user owns:~/.config/moonpay/wallets.json(AES-256-GCM-encrypted private keys for SOL/ETH/BTC/TRX)moonpay-cli / encryption-key(same-UID access, no extra prompt)~/.config/moonpay/credentials.json(encrypted MoonPay session)End-to-end: a single agent task that loads this skill on a hostile network = wallet drain.
The same host already serves over HTTPS — the same file uses
https://agents.allium.so/...three lines below for the skill-fetch URLs. So this is a one-character oversight on the most security-sensitive line of the skill, not a server limitation.Anything reviewers should know
sh. The scheme upgrade alone closes the network-attacker MITM path; signing is a follow-up worth considering.skills/moonpay-fund-polymarket/SKILL.md:38already uses HTTPS (raw.githubusercontent.com). No other unencrypted code-loading channels found.Diff
Test plan
https://agents.allium.so/cli/install.shresolves and serves the same install script (it does — verified during prep).http://URLs inskills/**/SKILL.md(verified — only DOCTYPE references, which are URIs, not fetched).