ClawHub
Back to skill

Security audit

Image Vision

Security checks for vulnerabilities and agentic risk

Overview

The skill’s image-analysis behavior is mostly coherent, but its setup instructions tell users to pipe a remote installer directly into a shell.

Review the setup carefully before installing. Prefer an official package manager or signed Ollama download instead of running the README’s `curl ... | sh` command, and only analyze images you are comfortable sending to a local Ollama service. Be aware that the optional clipboard helper can save clipboard images locally under your home directory.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:91
Finding

Unverified Remote Installer Is Piped Directly to a Shell

Content
View full analysis

Vulnerability Details

File Location: README.md, line 91
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
# 1. Install Ollama (skip if already installed)
#    macOS/Linux: curl -fsSL https://ollama.com/install.sh | sh
#    Windows:     https://ollama.com/download

Technical Analysis

The English Quick Start instructions recommend downloading a mutable script from https://ollama.com/install.sh and piping it directly into sh. This immediately executes whatever content the remote endpoint returns without a version pin, cryptographic signature check, checksum verification, or opportunity for inspection.

Ollama is a legitimate prerequisite for the declared image-analysis functionality, and the referenced domain is consistent with that dependency. However, direct remote-to-shell execution is not the minimum-risk method required to install it. HTTPS protects the connection in transit but does not make the retrieved payload immutable or protect users if the hosting infrastructure, DNS path, CDN, certificate chain, or upstream release process is compromised.

Attack Path

  1. An attacker compromises or gains control over the installer endpoint or a trusted component in its delivery chain.
  2. The endpoint returns a modified shell script containing attacker-selected commands.
  3. A user follows the documented Quick Start command.
  4. curl downloads the modified response and streams it directly to sh.
  5. The malicious commands execute immediately with the privileges of the invoking user.
  6. If the installer requests or is run with elevated privileges, the impact may extend to system-wide modification.

Impact Assessment

Successful exploitation permits arbitrary command execution under the installing user's account. This can expose files and credentials accessible to that user, modify user configuration, install additional software, ...[truncated 264 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer Ollama's official operating-system package manager or signed release package.
  • If a script is necessary, pin it to a specific release rather than a mutable endpoint.
  • Download the installer as a separate file instead of piping it directly to a shell.
  • Verify a publisher-provided cryptographic signature or SHA-256 checksum before execution.
  • Allow the user to inspect the downloaded script before running it.
  • Run installation with ordinary user privileges whenever possible and elevate only narrowly scoped operations that require it.
  • Document the expected source, version, checksum, and privilege requirements.

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:249
Finding

Duplicate Unverified Remote Installer Is Piped Directly to a Shell

Content
View full analysis

Vulnerability Details

File Location: README.md, line 249
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
# 1. Install Ollama
#    macOS/Linux: curl -fsSL https://ollama.com/install.sh | sh
#    Windows:     https://ollama.com/download

Technical Analysis

The localized Quick Start section repeats the same unverified remote installation pipeline. The command passes a mutable HTTPS response directly to a command interpreter. There is no release pinning, checksum or signature validation, local review step, or restriction on what the downloaded script can perform.

Installing Ollama is relevant to the Skill, but this execution pattern creates unnecessary supply-chain exposure and exceeds the minimum-risk installation method required for the declared functionality.

Attack Path

  1. An attacker alters the installer returned by ollama.com through compromise of the origin or another trusted delivery component.
  2. A user copies and runs the documented command.
  3. The malicious response is streamed directly into sh.
  4. The shell executes the payload before the user can inspect or validate it.
  5. The payload acts with the user's privileges and may gain broader access if elevation is granted.

Impact Assessment

Exploitation can result in arbitrary local command execution, access to user-readable images and other files, credential theft, configuration changes, installation of additional payloads, or persistence. The direct privilege level is that of the invoking user; potential scope becomes system-wide if administrative elevation is provided.

Remediation
View remediation

Remediation Suggestions

  • Replace the pipeline with official package-manager or signed-package instructions.
  • Pin the installer to a specific reviewed release.
  • Separate downloading from execution.
  • Verify the artifact against an independently published signature or checksum.
  • Instruct users to inspect the installer before running it.
  • Avoid administrative execution unless explicitly required, and document every operation that requires elevation.
  • Keep both language sections synchronized so neither reintroduces the unsafe command.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The README instructs users to fetch and immediately execute a remote shell script via curl ... | sh. This creates a supply-chain execution risk because any compromise of the remote host, CDN, DNS, TLS termination, or install script contents results in arbitrary code execution on the user's machine without inspection.

Content

Scanner excerpt · README.md (reported line 91)May include surrounding context.

bash
# 1. Install Ollama (skip if already installed)
#    macOS/Linux: curl -fsSL https://ollama.com/install.sh | sh
#    Windows:     https://ollama.com/download

# 2. Pull the vision model (~3.4 GB)

Chaining Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The | sh chaining is the dangerous execution step that turns a network fetch into immediate command execution. In a skill README, this is especially risky because users may copy-paste setup commands without scrutiny, amplifying the chance of silent compromise.

Content

Scanner excerpt · README.md (reported line 91)May include surrounding context.

bash
# 1. Install Ollama (skip if already installed)
#    macOS/Linux: curl -fsSL https://ollama.com/install.sh | sh
#    Windows:     https://ollama.com/download

# 2. Pull the vision model (~3.4 GB)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The Chinese quick-start repeats the same curl ... | sh pattern, which encourages users to execute unverified remote code directly in a shell. If the fetched installer is altered or intercepted, the command grants immediate code execution under the user's account.

Content

Scanner excerpt · README.md (reported line 249)May include surrounding context.

bash
# 1. 安装 Ollama（如已装则跳过）
#    macOS/Linux: curl -fsSL https://ollama.com/install.sh | sh
#    Windows:     https://ollama.com/download

# 2. 拉取视觉模型（约 3.4 GB）

Chaining Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

This instance uses shell chaining to directly execute network-retrieved content in the Chinese instructions as well. The bilingual duplication increases exposure by normalizing the unsafe pattern for a wider audience and making accidental execution more likely.

Content

Scanner excerpt · README.md (reported line 249)May include surrounding context.

bash
# 1. 安装 Ollama（如已装则跳过）
#    macOS/Linux: curl -fsSL https://ollama.com/install.sh | sh
#    Windows:     https://ollama.com/download

# 2. 拉取视觉模型（约 3.4 GB）

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description is written entirely in Chinese and presents the skill behavior in that language without any indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring, CLI description, help text, and status/error messages are all written only in Chinese, which imposes a specific language on users. The file does not offer any language selection or explain that the tool is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/clip_snap.py (reported line 66)May include surrounding context.

python
Write-Output "NO_IMAGE"
}
"""
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_script],
            input=filepath,
            capture_output=True, text=True, timeout=10

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/clip_snap.py (reported line 96)May include surrounding context.

python
try:
            import subprocess
            # 安全：通过 stdin 传递文本，避免注入
            result = subprocess.run(
                ["powershell", "-NoProfile", "-Command", "$txt = $input | Out-String; Set-Clipboard -Value $txt"],
                input=text,
                capture_output=True, text=True, timeout=5

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring, usage text, and argument descriptions are all written only in Chinese, and the script does not provide any language selection or explain that it is intended solely for a Chinese-speaking environment. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.