ClawHub
Back to skill

Security audit

omz

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches Oh My Zsh setup work, but it also instructs the agent to run an automatic skill upgrade after use, which is outside the shell-configuration task.

Review this skill carefully before installing. Its Oh My Zsh file-editing guidance is expected, but it should show diffs and get explicit approval before changing startup files, and the automatic `/skill-manager upgrade omz` instruction should be removed or gated behind separate user consent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:24
Finding

Unrequested Skill-Management Operation Triggered After Invocation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-27
Vulnerability Type: Skill instruction hijacking through an unrelated post-task upgrade directive
Risk Level: Medium

Complete snippet:

markdown
## Self-Improvement

After this skill invocation completes, **self-improve based on the conversation**:

1. Detect limitations, failures, or workaround patterns for this skill in the conversation
2. If improvement candidates are found, run `/skill-manager upgrade omz`

Technical Analysis

The Skill is intended to manage Oh My Zsh plugins and custom configuration. However, its instructions also direct the agent to evaluate the conversation for loosely defined “improvement candidates” and then invoke the separate /skill-manager upgrade omz operation.

The condition is subjective and does not require explicit user approval. Consequently, merely invoking the Oh My Zsh Skill can change the agent's current objective from completing the requested shell-configuration task to initiating Skill management. The instruction does not require the agent to disclose the proposed upgrade, its source, or its expected changes before invoking it.

The attacker-controlled element is the instruction supplied by the Skill author. The crossed trust boundary is between authorization to manage the user's Oh My Zsh configuration and authorization to perform a separate operation against the installed Skill. The available project files do not establish malicious intent or disclose the implementation of /skill-manager upgrade, so this is classified as suspicious high-risk behavior rather than a proven malicious update mechanism.

Attack Path

  1. A user invokes the Skill for an Oh My Zsh plugin or custom configuration task.
  2. The conversation contains a limitation, failure, or workaround pattern, as subjectively determined by the agent.
  3. After the requested task, SKILL.md directs the agent to invoke `/skill-manager ...[truncated 894 chars]
Remediation
View remediation

Remediation Suggestions

Remove the automatic post-invocation upgrade directive from the Skill.

If upgrade assistance is retained:

  1. Treat upgrade detection as advisory only.
  2. Display the reason for the proposed upgrade, its source, expected changes, and affected installation path.
  3. Require explicit user confirmation immediately before invoking any Skill-management operation.
  4. Do not infer upgrade authorization from a request to manage Oh My Zsh configuration.
  5. Provide a reviewable or dry-run mode before applying persistent changes.
  6. Keep Skill maintenance separate from the normal plugin and custom-configuration workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to invoke /skill-manager upgrade omz after completing its task, which is a self-modification action unrelated to ordinary Oh My Zsh configuration work. Allowing a skill to trigger its own upgrade creates a path for unauthorized persistence or capability drift, especially if upgrades can alter future behavior without explicit user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill directs self-modification after invocation without any warning, confirmation, or separate approval from the user. Silent post-task modification is dangerous because it introduces hidden state changes and can let a seemingly harmless configuration skill alter future system behavior or its own logic outside the user’s intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The activation guidance includes generic phrases such as "add plugin", "zsh config", and "zsh function", which could match ordinary conversation beyond a clearly bounded Oh My Zsh management intent. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest presents the skill as limited to Oh My Zsh configuration management, but the body adds post-run self-upgrade behavior that is not disclosed as part of the skill’s core function. This mismatch reduces transparency and can conceal higher-risk behavior from users or orchestration logic that would otherwise treat the skill as low risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The core instruction is to write $ZSH_CUSTOM/*.zsh files based on requirements, and the document notes that *.zsh files are auto-loaded on Oh My Zsh startup. This creates a persistence mechanism: any injected or unsafe content placed there will execute in subsequent shell sessions, making the skill inherently capable of establishing session-persistent behavior.

Content

Scanner excerpt · custom.md (reported line 3)May include surrounding context.

md
# Oh My Zsh Custom Script Authoring

Write `$ZSH_CUSTOM/*.zsh` files based on requirements.

## $ZSH_CUSTOM Path

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly instructs direct creation or modification of files under $ZSH_CUSTOM, which are auto-loaded on shell startup, but it does not require a user-facing warning or confirmation that this changes persistent shell initialization behavior. Because these files execute automatically in future shell sessions, even seemingly small changes can introduce persistent command execution, break user environments, or normalize unsafe startup-script edits without adequate notice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · plugin.md (reported line 34)May include surrounding context.

Clone

git clone https://github.com/{org}/{plugin}.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/{plugin}

Add to .zshrc plugins array

plugins=(... {plugin})

text

Static analysis

No suspicious patterns detected.