Security hardening: Genkit skills execute an unverified remote installer

Open
  • Is something wrong?
#218 1 comment 0 reactions 0 assignees View on GitHub

@chethanuk is already working on this.

Since Sep 4, 2026.

  • #1 by @chethanuk — closed without merging
  • #2 by @chethanuk — open

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
dart, go
Domain
devops, security

Research direction

Start with skills/cloud/genkit-go/SKILL.md and skills/cloud/genkit-dart/SKILL.md, then inspect the referenced cli.genkit.dev installer and its /latest binary download. Determine which immutable version and integrity controls are available; done means both skills avoid piping mutable remote content into a shell and verify the selected artifact before execution.

Written by the indexing model from the issue text.

Description

AgentCapabilityDetonator, an agent-capability security scanner developed by
SureNode, identified a software supply-chain concern in the Genkit Go and
Genkit Dart skills.

Affected skills

  • skills/cloud/genkit-go/SKILL.md
  • skills/cloud/genkit-dart/SKILL.md

Both recommend:

curl -sL cli.genkit.dev | bash

**Observation**
This command downloads mutable remote content and immediately executes it. At the time of review, the installer also downloads the Genkit binary from a mutable /latest URL. I could not identify checksum, signature, or provenance verification before the binary is installed and executed.

The installer may conditionally use passwordless sudo when installing into a system directory.
**Potential impact**
If the installer endpoint, hosting account, DNS, CDN, or release-delivery pipeline were compromised, modified code could be executed on developer machines. This is a hardening observation; I found no evidence that Genkit or its infrastructure is currently compromised.

**Suggested remediation**
1. Publish immutable, versioned Genkit CLI artifacts.
2. Publish signed checksums, signatures, or verifiable provenance through a
   trusted release channel.
3. Update the skills to download a specific version and verify it before
   execution.
4. Avoid piping mutable remote scripts directly into a shell.
5. Avoid elevated installation unless explicitly requested by the user.

Could the Google Skills and Genkit teams advise whether integrity controls exist that are not currently visible to consumers?

**Attribution**
Identified through static analysis with AgentCapabilityDetonator by SureNode and manually validated against the current public Genkit installer.

Nesh Chandarana
Founder / CEO - [SureNode.ai](http://surenode.ai/)
[Book a time on my calendar](https://calendar.app.google/n5x5uY7UQF83AHqj6)
[Connect with me on Linkedin](https://www.linkedin.com/in/nesh-chandarana/)
[Follow-us on Linkedin](https://www.linkedin.com/company/surenode/?viewAsMember=true)
Dominant language
Python
Stars
23.1k
Forks
1.9k
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from google/skills

All issues in google/skills

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.