moru
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION] (CRITICAL): The skill documentation includes a 'Quick Start' command:
curl -fsSL https://moru.io/cli/install.sh | bash. Piping an unverified remote script directly to a shell is a highly dangerous pattern as the script content could be maliciously modified by the domain owner or an attacker who compromises the domain, leading to full system compromise. - [EXTERNAL_DOWNLOADS] (HIGH): The skill references an external installation script from
moru.io. This domain is not listed as a trusted source (e.g., GitHub, Google, Microsoft), meaning the integrity and safety of the downloaded content cannot be verified. - [COMMAND_EXECUTION] (MEDIUM): The skill encourages the execution of CLI commands that handle authentication (
moru auth login) and environment variables (MORU_API_KEY). While functional, these commands operate on sensitive data that could be exfiltrated if the CLI tool installed via the RCE vector is malicious.
Recommendations
- CRITICAL: Downloads and executes remote code from untrusted source(s): https://moru.io/cli/install.sh - DO NOT USE
- AI detected serious security threats
Audit Metadata