ClawHub
Back to skill

Security audit

index1 Doctor

Security checks for vulnerabilities and agentic risk

Overview

This is a small diagnostic skill whose behavior is mostly transparent, but users should review installation fix commands before running them.

Before installing, treat the diagnostic checks as low risk, but do not blindly run the suggested Ollama curl | sh command. Prefer official install documentation, inspect downloaded scripts first, and approve any package installation or indexing command only for projects you intend to modify or index.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:66
Finding
Unverified Remote Installer Piped Directly into a Shell## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```markdown | Ollama | Connected | `curl -fsSL https://ollama.com/install.sh \| sh` | ``` ### Technical Analysis The documented remediation command retrieves a mutable shell script from an external URL and immediately executes it with `sh`. There is no version pinning, checksum validation, signature verification, or opportunity to inspect the downloaded content before execution. HTTPS protects transport under normal conditions, but it does not make the remotely hosted script immutable or independently verify its contents. The effective code can change after this Skill has been audited. A compromise of the remote hosting infrastructure, its deployment process, domain or certificate controls, or another relevant part of the delivery chain could therefore turn this recommendation into arbitrary local code execution. Installing Ollama is not required to perform the Skill's declared diagnostic function. The Skill can detect and report that optional Ollama connectivity is unavailable without retrieving or executing external code. Consequently, the recommendation exceeds the minimum behavior necessary for diagnosis. ### Attack Path 1. A user invokes the Skill to diagnose an `index1` environment. 2. The Ollama connectivity check reports that Ollama is unavailable. 3. The agent or user follows the documented failure-remediation command. 4. `curl` downloads the current response from `https://ollama.com/install.sh`. 5. The response is passed directly to `sh` without local review or integrity verification. 6. Any malicious commands supplied through a compromised delivery chain execute with the privileges of the user running the command. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. This co ...[truncated 544 chars]
Remediation
## Remediation Suggestions 1. Remove the `curl | sh` command from the automated failure-remediation table. 2. Report Ollama as an optional missing component and link users to the official installation documentation instead of executing an installer. 3. Require explicit, informed user approval before performing any software installation. 4. Prefer a trusted operating-system package manager or a version-pinned release artifact. 5. If a standalone artifact must be downloaded, save it to disk rather than piping it into a shell. 6. Verify a publisher signature or a checksum obtained through an independently trusted channel before execution. 7. Display the exact version, source, destination, and commands to be executed so the user can review them. 8. Run installation with ordinary user privileges whenever possible and request elevation only for specific operations that demonstrably require it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Content
| Python | >= 3.10 | Install Python 3.11+ |
| SQLite | >= 3.43.0 | Auto-degrades, no action needed |
| sqlite-vec | Loaded | `pip install index1` (bundled) |
| Ollama | Connected | `curl -fsSL https://ollama.com/install.sh \| sh` |
| Model | Available | `ollama pull nomic-embed-text` |
| CJK | jieba loaded | `pip install index1[chinese]` |
| Index | Has documents | `index1 index ./src ./docs` |
Confidence
97% confidence
Finding
The skill recommends a classic 'curl | sh' installation pattern for Ollama, which executes a remotely fetched script directly in the shell without inspection or integrity verification. If the remote server, transport, DNS, or distribution path is compromised, users could run attacker-controlled code on their system; in a diagnostic skill context, this is especially risky because users may treat remediation guidance as trustworthy and execute it immediately.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The description says users can 'ask the agent to diagnose index1' without defining specific trigger phrases or boundaries. That natural-language condition is broad enough to match ordinary troubleshooting requests and could cause unintended invocation compared with a narrower command-only trigger.

Static analysis

No suspicious patterns detected.