ClawHub
Back to skill

Security audit

Moli CDP Server

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its install instructions execute a mutable remote installer without verification or clear user approval.

Install only if you are comfortable reviewing and trusting the Moli installer source. Prefer a pinned release with checksum or signature verification, and do not import cookies or persistent browser profiles unless you intend the automation session to use those account sessions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Mutable Remote Installer Scripts Are Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–27
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash
```bash
curl --proto '=https' --tlsv1.2 -fsSL \
  https://github.com/lexmount/moli/releases/latest/download/moli-installer.sh | sh

On Windows, use PowerShell:

powershell
irm https://github.com/lexmount/moli/releases/latest/download/moli-installer.ps1 | iex
text

### Technical Analysis

The Skill instructs the agent to download installer scripts from an external GitHub release URL and pass their contents directly to a command interpreter. On Linux and macOS, the response is piped to `sh`; on Windows, `Invoke-RestMethod` is combined with `Invoke-Expression`.

The `/releases/latest/` URL is mutable and does not identify an immutable release or artifact. Consequently, the code executed during a future invocation can differ from the code available during this audit. No checksum, digital signature, pinned version, local review step, or publisher-identity verification is required before execution.

TLS options on the Unix command protect the network transport but do not establish that the remotely hosted script is safe or unchanged. If the repository, release process, hosting account, or installer artifact is compromised, the replacement payload will execute immediately.

Installing the required `moli` executable is related to the declared CDP-server functionality. However, executing an unverified remote script is not the minimum-risk installation method. It gives externally controlled code all permissions available to the user running the agent.

### Attack Path

1. The agent attempts to resolve `moli` from `PATH` and finds that it is unavailable.
2. Following `SKILL.md`, it requests the mutable `latest` installer from the external repository.
3. An attacker who has compromised the repository, release pipeline, maintainer account, or hosted 
...[truncated 1257 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | sh and irm | iex installation patterns.
  2. Pin installation to a specific, immutable Moli version rather than using /releases/latest/.
  3. Download the installer or binary to a local file without executing it automatically.
  4. Publish and verify a cryptographic checksum, such as SHA-256, obtained through a separately protected and version-pinned channel.
  5. Prefer a verifiable publisher signature in addition to a checksum, and fail closed if signature verification is unavailable or unsuccessful.
  6. Present the resolved version, source URL, destination, expected checksum, and requested changes to the user before requesting explicit approval to execute or install anything.
  7. Prefer a trusted operating-system package manager or another installation channel that provides package signing, version pinning, and auditable package metadata.
  8. Run installation with ordinary user privileges and avoid privilege elevation unless it is separately justified and explicitly approved.
  9. Document the files, directories, network access, and configuration changes made by the installer.
  10. After installation, verify the installed executable's integrity and run moli --version only after all authenticity checks succeed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | sh pattern turns untrusted remote content into immediate shell execution, removing any review boundary between download and code execution. In a skill context, this is especially dangerous because an automated agent may follow the instruction non-interactively, resulting in full arbitrary command execution under the agent's privileges.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash
   curl --proto '=https' --tlsv1.2 -fsSL \
     https://github.com/lexmount/moli/releases/latest/download/moli-installer.sh | sh

On Windows, use PowerShell:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

This markdown file documents runtime options including --profile-dir for persistent storage and cookies and --cookie-file to import cookies, but it does not warn that these actions may use or expose sensitive authentication/session data. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs fetching and executing an installer script directly from the internet without any integrity verification, signature check, or pinned version. If the GitHub release asset, upstream account, network path, or latest-release pointer is compromised, the agent would execute attacker-controlled code on the host immediately.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Linux or macOS:

bash
curl --proto '=https' --tlsv1.2 -fsSL \
  https://github.com/lexmount/moli/releases/latest/download/moli-installer.sh | sh