Siphonclaw Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:20 PM UTC
• Version: 1.2.0

Overview

SiphonClaw appears purpose-aligned, but it asks users to run an unverified remote installer and handles broad document/image data with cloud and web-search paths that are not clearly scoped.

Review before installing. Use a safer Ollama installation method instead of piping curl to sh, inspect and pin external dependencies where possible, and avoid ingesting sensitive or regulated documents until you understand what is stored locally and what may be sent to OpenRouter, Brave Search, Telegram, AgentMail, or other configured services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:254

Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:254
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

bash

curl -fsSL https://ollama.com/install.sh | sh

Technical Analysis

The setup instructions download a mutable shell script from an external URL and execute it immediately. The command provides no version pinning, checksum verification, cryptographic signature validation, or opportunity to inspect the downloaded content before execution.

HTTPS protects the connection in transit under normal conditions, but it does not establish that the remote script is immutable or safe. If the Ollama website, hosting infrastructure, DNS resolution, certificate trust path, or release process is compromised, the command could deliver arbitrary attacker-controlled shell commands.

Ollama supports the skill's documented local OCR and embedding mode, but piping its installer directly into a shell is not required for that functionality. The documentation also provides a full-cloud mode that does not require Ollama. A package-manager installation or separately downloaded and verified artifact would meet the functional requirement with less risk and better adherence to least privilege.

Attack Path

1. An attacker compromises the remote installer, its hosting infrastructure, or another trusted part of its delivery path.
2. The attacker modifies the response served from https://ollama.com/install.sh to include malicious shell commands.
3. A user follows the installation instructions in SKILL.md.
4. curl retrieves the current attacker-controlled response.
5. The pipe sends the response directly to sh, without integrity verification or review.
6. The malicious commands execute with the privileges of the user running the setup command.
7. The payload can access resources available to that user and may attempt further privilege escalation or persistence, although ...[truncated 1023 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh pipeline from the setup instructions.
2. Prefer an official operating-system package manager and pin an explicit Ollama version where supported.
3. If a standalone installer is necessary:
   • Download it to a local file as a separate step.
   • Use a version-specific, immutable release URL.
   • Obtain the expected checksum or signature through an authenticated release channel.
   • Verify the artifact before execution.
   • Inspect the script and execute it only after successful verification.
4. Document the permissions and filesystem changes required by the installer, and advise users to avoid running the entire setup as root.
5. Fail closed when verification cannot be completed; do not continue with an unverified artifact.
6. For reproducible installation, pin Python dependencies and publish lock files or hash-verified requirements for the externally referenced implementation.
7. Retain the documented full-cloud mode as an alternative for users who do not need or trust the local Ollama installation path.

A safer pattern is:

bash

curl -fL --output ollama-install.sh \
  https://example.invalid/versioned/ollama-install.sh

echo "EXPECTED_SHA256  ollama-install.sh" | sha256sum --check -
less ollama-install.sh
sh ollama-install.sh

The placeholder URL and checksum must be replaced with a versioned official release artifact and its independently published expected digest.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 121)May include surrounding context.

md

pip install -r requirements.txt

# 2. Configure
cp .env.example .env
# Edit .env with your API keys (see Configuration below)

# 3. Install local models (recommended - free, unlimited ingestion)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 122)May include surrounding context.

md

# 2. Configure
cp .env.example .env
# Edit .env with your API keys (see Configuration below)

# 3. Install local models (recommended - free, unlimited ingestion)
ollama pull qwen3-vl:latest      # 6.1 GB - OCR and vision

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The setup instructions recommend fetching a remote script and piping it directly to a shell, which executes unaudited code from the network with the user's privileges. If the upstream site, transport path, or published install script is compromised, users could suffer arbitrary code execution and full workstation or server compromise.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md

pip install -r requirements.txt

# 2. Install Ollama and pull local models (~10 GB total)
curl -fsSL https://ollama.com/install.sh | sh
ollama pull qwen3-vl:latest          # 6.1 GB - OCR
ollama pull bge-m3:latest             # ~1.5 GB - text embeddings
ollama pull qwen3-vl-embed:2b        # ~2 GB - visual embeddings

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The shell pipeline chains remote content directly into command execution, eliminating any review boundary between download and execution. In practice this amplifies supply-chain risk and makes command-injection or malicious installer behavior immediately exploitable if the fetched content is altered.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md

pip install -r requirements.txt

# 2. Install Ollama and pull local models (~10 GB total)
curl -fsSL https://ollama.com/install.sh | sh
ollama pull qwen3-vl:latest          # 6.1 GB - OCR
ollama pull bge-m3:latest             # ~1.5 GB - text embeddings
ollama pull qwen3-vl-embed:2b        # ~2 GB - visual embeddings

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README encourages ingestion from shared drives, URLs, email, and Telegram and promotes broad indexing/searchability, but it does not warn users that sensitive documents may be transmitted to cloud APIs, persisted in local/vector stores, or exposed through external channels. In a document-intelligence system handling enterprise manuals, contracts, contact lists, and field notes, omission of data-handling and privacy cautions materially increases the risk of accidental sensitive-data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that image identification may fall back to web search when local confidence is low, but it does not give a user-facing warning that image-derived text, identifiers, or context could be shared with an external search provider. Because users may submit photos of internal equipment, labels, or error screens, this creates a meaningful risk of unintentional external disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents a hybrid/cloud mode that sends document and image-derived content to external providers, but it does not clearly warn users that potentially sensitive data may leave the local environment. In a document-intelligence pipeline, this omission can lead to accidental disclosure of proprietary, personal, or regulated content during ingestion or query-time processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.