ClawHub
Back to skill

Security audit

AddressZen

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent AddressZen connector, but its setup instructions tell users to run unverified remote installer scripts directly in a shell.

Install only if you trust OOMOL's CLI distribution path. Prefer an official package or a downloaded installer whose signature or checksum you can verify, and avoid running the pipe-to-shell setup commands from an elevated shell. Routine AddressZen read actions appear aligned with the skill's purpose.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Bash Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 57
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The first-time setup instructions pipe a remotely retrieved installation script directly into Bash. The script is not pinned to an immutable release, downloaded for inspection, or validated using a cryptographic signature or checksum.

Consequently, the code that ultimately executes can change after the Skill has been reviewed. HTTPS protects the connection in transit but does not protect against compromise of the vendor domain, hosting infrastructure, release pipeline, DNS or certificate trust chain, or the vendor account controlling the installer. This behavior is unnecessary for normal connector operations when the CLI is already installed and creates a high-risk supply-chain execution channel during setup.

No evidence in the reviewed file proves that the current vendor-hosted installer is malicious. The vulnerability is the unverified retrieval and immediate execution mechanism.

Attack Path

  1. The oo CLI is unavailable, causing the documented first-time installation path to be used.
  2. An attacker compromises or otherwise gains control over the installer served from https://cli.oomol.com/install.sh.
  3. The user or agent runs the documented command.
  4. curl retrieves the attacker-controlled response without saving it for review.
  5. Bash immediately interprets and executes the response.
  6. The payload performs arbitrary operations with the privileges of the account running the command.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's privileges. This can expose files and environment variables available to that user, alter user-owned configuration or executables, in ...[truncated 428 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the curl | bash workflow with an installation method provided by a trusted operating-system package manager.
  • Pin the CLI to a specific, immutable release and obtain it from the vendor's official release channel.
  • Download the installer or package to disk before execution so that it can be inspected.
  • Publish a cryptographic checksum through an independently protected channel and verify it before execution.
  • Prefer signed packages and verify the vendor's release signature against a documented, trusted public key.
  • Abort installation if checksum or signature verification fails.
  • Do not request or recommend elevated privileges unless a documented installation step strictly requires them.
  • Keep the existing instruction that installation is only a fallback after an actual command not found error.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote PowerShell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup command uses Invoke-RestMethod through its irm alias to retrieve mutable content from an external URL and passes the response directly to Invoke-Expression through iex. Invoke-Expression evaluates the downloaded text as PowerShell code without pinning the payload, verifying its integrity, validating an Authenticode signature, or allowing prior inspection.

This creates an external code-execution channel whose effective payload may change after audit. Although the URL appears associated with the documented CLI provider, domain ownership alone does not establish the integrity of every future response.

No evidence in the reviewed file establishes that the currently hosted PowerShell installer contains malicious code. The confirmed issue is the unsafe remote retrieval and immediate evaluation pattern.

Attack Path

  1. The oo CLI is missing on a Windows environment.
  2. The vendor's installer endpoint or its delivery infrastructure is compromised and begins returning attacker-controlled PowerShell.
  3. The user or agent follows the documented setup command.
  4. Invoke-RestMethod downloads the malicious response.
  5. The pipeline supplies that response directly to Invoke-Expression.
  6. PowerShell executes the payload in the current security context without an intervening integrity check or review step.

Impact Assessment

Successful exploitation allows arbitrary PowerShell execution with the privileges of the invoking process. The payload could access user-readable files and environment variables, change user configuration, download further components, or transmit information available to the curr ...[truncated 350 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Distribute a version-pinned, signed MSI, MSIX, or PowerShell package through an official release channel or trusted package manager.
  • Download the artifact separately and verify its cryptographic digest before installation.
  • For PowerShell scripts, require a valid Authenticode signature and verify that the signer matches the documented vendor identity.
  • Publish expected checksums and signing-key information through a separately protected channel.
  • Present the downloaded script for inspection rather than evaluating the network response directly.
  • Abort execution on signature, certificate, or checksum validation failure.
  • Warn users not to run the installer from an elevated session unless a specific, documented operation requires administrator privileges.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software via a remote script piped directly into a shell (curl ... | bash), which executes unverified code from the network with the user's privileges. If the distribution endpoint, transport chain, or hosting account is compromised, this becomes an easy remote code execution path, and embedding it in a skill normalizes unsafe operator behavior.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY AddressZen request" and "Whenever a task involves AddressZen," which is an expansive activation condition rather than a narrowly scoped trigger. It does not provide exclusions or negative examples, so routine mentions of AddressZen could trigger the skill even when direct use is unnecessary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.