ClawHub
Back to skill

Security audit

index1 Doctor

Security checks for vulnerabilities and agentic risk

Overview

This is a small diagnostic skill whose behavior is mostly transparent, but users should review installation fix commands before running them.

Before installing, treat the diagnostic checks as low risk, but do not blindly run the suggested Ollama curl | sh command. Prefer official install documentation, inspect downloaded scripts first, and approve any package installation or indexing command only for projects you intend to modify or index.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:66
Finding

Unverified Remote Installer Piped Directly into a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

markdown
| Ollama | Connected | `curl -fsSL https://ollama.com/install.sh \| sh` |

Technical Analysis

The documented remediation command retrieves a mutable shell script from an external URL and immediately executes it with sh. There is no version pinning, checksum validation, signature verification, or opportunity to inspect the downloaded content before execution.

HTTPS protects transport under normal conditions, but it does not make the remotely hosted script immutable or independently verify its contents. The effective code can change after this Skill has been audited. A compromise of the remote hosting infrastructure, its deployment process, domain or certificate controls, or another relevant part of the delivery chain could therefore turn this recommendation into arbitrary local code execution.

Installing Ollama is not required to perform the Skill's declared diagnostic function. The Skill can detect and report that optional Ollama connectivity is unavailable without retrieving or executing external code. Consequently, the recommendation exceeds the minimum behavior necessary for diagnosis.

Attack Path

  1. A user invokes the Skill to diagnose an index1 environment.
  2. The Ollama connectivity check reports that Ollama is unavailable.
  3. The agent or user follows the documented failure-remediation command.
  4. curl downloads the current response from https://ollama.com/install.sh.
  5. The response is passed directly to sh without local review or integrity verification.
  6. Any malicious commands supplied through a compromised delivery chain execute with the privileges of the user running the command.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. This co ...[truncated 544 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | sh command from the automated failure-remediation table.
  2. Report Ollama as an optional missing component and link users to the official installation documentation instead of executing an installer.
  3. Require explicit, informed user approval before performing any software installation.
  4. Prefer a trusted operating-system package manager or a version-pinned release artifact.
  5. If a standalone artifact must be downloaded, save it to disk rather than piping it into a shell.
  6. Verify a publisher signature or a checksum obtained through an independently trusted channel before execution.
  7. Display the exact version, source, destination, and commands to be executed so the user can review them.
  8. Run installation with ordinary user privileges whenever possible and request elevation only for specific operations that demonstrably require it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill recommends a classic 'curl | sh' installation pattern for Ollama, which executes a remotely fetched script directly in the shell without inspection or integrity verification. If the remote server, transport, DNS, or distribution path is compromised, users could run attacker-controlled code on their system; in a diagnostic skill context, this is especially risky because users may treat remediation guidance as trustworthy and execute it immediately.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
| Python | >= 3.10 | Install Python 3.11+ |
| SQLite | >= 3.43.0 | Auto-degrades, no action needed |
| sqlite-vec | Loaded | `pip install index1` (bundled) |
| Ollama | Connected | `curl -fsSL https://ollama.com/install.sh \| sh` |
| Model | Available | `ollama pull nomic-embed-text` |
| CJK | jieba loaded | `pip install index1[chinese]` |
| Index | Has documents | `index1 index ./src ./docs` |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says users can 'ask the agent to diagnose index1' without defining specific trigger phrases or boundaries. That natural-language condition is broad enough to match ordinary troubleshooting requests and could cause unintended invocation compared with a narrower command-only trigger.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.