ClawHub
Back to skill

Security audit

Nodetool

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent NodeTool documentation, but its install instructions repeatedly encourage executing mutable remote scripts directly, including unattended modes.

Review the installer before running it. Prefer a pinned release or downloaded script with a verified checksum or signature, avoid non-interactive install modes unless you are in an isolated least-privilege environment, and do not paste real auth tokens directly into commands that may be logged.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:36
Finding

Mutable Unix installer is downloaded and executed directly by a shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-51; duplicated at lines 385-400
Vulnerability Type: Remote payload retrieval and execution through curl | bash
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash
bash
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash --prefix ~/.nodetool
bash
# Linux/macOS - use -y
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash -y

The same installation instructions are repeated at lines 385-400.

Technical Analysis

These commands retrieve a shell script from an external URL and send it directly to Bash without saving it for inspection or verifying its contents. The URL references the mutable main branch rather than an immutable commit or release artifact. Consequently, the code executed by a user can differ from the content that existed when this skill was audited.

HTTPS protects the connection in transit, but it does not protect against compromise of the upstream repository, maintainer account, branch, release process, or hosting infrastructure. No cryptographic checksum or signature is provided. The -y variation additionally suppresses installer confirmation prompts, reducing the opportunity to detect unexpected operations.

This behavior is not required at this privilege level for the skill's declared documentation and CLI-usage functionality. Installation can be performed through a pinned, inspectable artifact under ordinary user privileges. Piping an unpinned remote script into a shell unnecessarily gives the current upstream content general code-execution capability.

The project documentation states that the installer creates a NodeTool environment, installs Python packages, and creates wrapper scripts. However, because the remote sc ...[truncated 1912 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all direct curl | bash installation patterns, including the duplicated section.
  2. Link to a versioned release artifact or pin the installer to an immutable Git commit instead of refs/heads/main.
  3. Require users to download the installer before execution:
    bash
    curl -fL -o install.sh https://raw.githubusercontent.com/nodetool-ai/nodetool/PINNED_COMMIT/install.sh
  4. Publish a SHA-256 checksum through a separately protected release channel and verify it before execution:
    bash
    echo "EXPECTED_SHA256  install.sh" | sha256sum -c -
  5. Prefer cryptographic release signatures with documented key verification over checksums alone.
  6. Instruct users to inspect the downloaded script before running it:
    bash
    less install.sh
bash install.sh --prefix "$HOME/.nodetool"
  7. Keep installation user-local by default and explicitly warn against running the installer with sudo or as root.
  8. Avoid recommending non-interactive installation unless necessary for CI. For CI, pin every artifact and dependency and use an isolated, least-privileged runner.
  9. Document the exact files, packages, network endpoints, and environment changes made by the installer.
  10. Remove the duplicated installation section to prevent insecure instructions from surviving future partial edits.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:54
Finding

Mutable Windows installer is executed directly through PowerShell Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54-67; duplicated at lines 403-416
Vulnerability Type: Remote payload retrieval and execution through irm | iex
Risk Level: High

Vulnerable Code

powershell
# Windows - use -Yes
irm https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.ps1 | iex; .\install.ps1 -Yes
powershell
irm https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.ps1 | iex

The same PowerShell instructions are repeated at lines 403-416.

Technical Analysis

irm is the PowerShell alias for Invoke-RestMethod, while iex is the alias for Invoke-Expression. Piping the response into iex evaluates the externally supplied response as PowerShell code immediately. The response is not retained for review and is not checked against a signature or expected digest.

The URL references the mutable main branch. Thus, control of the upstream installer content is effectively equivalent to code execution on systems whose users follow these instructions. HTTPS alone does not establish that the fetched script is the specific version reviewed or intended by the project.

The -Yes form is presented as non-interactive installation, further reducing user oversight. The combined command also invokes .\install.ps1 -Yes after evaluating the remote response. The audited documentation does not establish whether evaluating the response creates that local file, so this sequence is also ambiguous and may produce behavior that differs depending on the upstream script and current working directory.

Direct remote evaluation exceeds the minimum privilege needed to document or install the declared workflow tool. A pinned installer can be downloaded, authenticated, inspected, and then run with ordinary user privileges.

Attack Path

  1. An attacker gains the ability to alter install.ps1 on the referenced main branch, such as t ...[truncated 1547 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all irm | iex and other Invoke-Expression installation instructions.
  2. Publish the installer as a versioned release artifact and pin documentation to an immutable version or commit.
  3. Download the script to disk before execution:
    powershell
    Invoke-WebRequest -Uri "https://raw.githubusercontent.com/nodetool-ai/nodetool/PINNED_COMMIT/install.ps1" -OutFile ".\install.ps1"
  4. Publish and verify an Authenticode signature or a checksum obtained from a separately protected release channel:
    powershell
    Get-FileHash .\install.ps1 -Algorithm SHA256
Get-AuthenticodeSignature .\install.ps1
  5. Require inspection of the downloaded script before execution and document the expected signer or digest.
  6. Run the installer from a non-administrator PowerShell session unless a specific privileged operation is documented and separately approved.
  7. Avoid -Yes in general user instructions. For unattended CI use, employ isolated least-privileged runners and pin all retrieved artifacts.
  8. Separate downloading from execution and stop on failed validation; do not combine remote evaluation and subsequent local execution in one command.
  9. Document whether the installer creates install.ps1, where files are installed, and which registry, profile, PATH, service, or package changes are expected.
  10. Remove the duplicate installation section so all copies of the unsafe command are eliminated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The explicit shell chaining operator is the dangerous part of the install one-liner because it directly feeds untrusted remote content into an interpreter. In this skill context, users are likely to copy and execute the command verbatim, which makes the exploitation path straightforward if the source is ever tampered with.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Quick one-line installation:

bash
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash

With custom directory:

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This is the same direct chaining abuse pattern repeated in a second installation section. Duplicate exposure increases the likelihood of unsafe copy-paste execution and normalizes a high-risk installation practice.

Content

Scanner excerpt · SKILL.md (reported line 385)May include surrounding context.

Quick one-line installation:

bash
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash

With custom directory:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation includes examples that pass an auth token directly on the command line, which can expose secrets through shell history, process listings, terminal logs, and CI job output. In a skill/agent context where users may copy-paste commands verbatim, this creates a realistic risk of credential leakage even though the file is only documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill advertises a command to view settings and secrets without warning that sensitive values may be printed to the console, logged, or captured in transcripts. This is dangerous in shared terminals, recorded sessions, support screenshots, or agent execution environments where stdout may be persisted.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The documentation instructs users to fetch a remote script and execute it immediately with bash, eliminating an inspection step and trusting mutable network-delivered content at execution time. If the upstream repository, DNS/TLS path, or delivery channel is compromised, users can execute arbitrary code on their machine.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Quick one-line installation:

bash
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash

With custom directory:

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

This is another direct remote-script execution pattern, only with a custom prefix argument. The risk remains arbitrary code execution from mutable upstream content without integrity verification or review.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

With custom directory:

bash
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash --prefix ~/.nodetool

Non-interactive mode (automatic, no prompts):

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The non-interactive install example combines remote script execution with automatic confirmation flags, making accidental or large-scale unsafe execution more likely in CI/CD or automation. This increases blast radius because compromise of the fetched script can lead to unattended code execution across multiple systems.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

bash
# Linux/macOS - use -y
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash -y

# Windows - use -Yes
irm https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.ps1 | iex; .\install.ps1 -Yes

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

This repeats the same remote pipe-to-bash installation pattern later in the file. Repetition reinforces unsafe operator behavior and increases the chance users will adopt the risky shortcut.

Content

Scanner excerpt · SKILL.md (reported line 385)May include surrounding context.

Quick one-line installation:

bash
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash

With custom directory:

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

This duplicate custom-directory example still executes a remotely fetched script immediately. The custom prefix does not reduce the core arbitrary-code-execution risk.

Content

Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.

With custom directory:

bash
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash --prefix ~/.nodetool

Non-interactive mode (automatic, no prompts):

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

This duplicate unattended installation example again promotes automatic execution of network-fetched shell or PowerShell code. In automated environments, such patterns are especially risky because they may run with elevated permissions and without human review.

Content

Scanner excerpt · SKILL.md (reported line 400)May include surrounding context.

bash
# Linux/macOS - use -y
curl -fsSL https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.sh | bash -y

# Windows - use -Yes
irm https://raw.githubusercontent.com/nodetool-ai/nodetool/refs/heads/main/install.ps1 | iex; .\install.ps1 -Yes

Static analysis

No suspicious patterns detected.