ClawHub
Back to skill

Security audit

Xweather

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Xweather connector, but its setup instructions tell users to run remote installer scripts directly, which deserves review before use.

Before installing, verify the oo CLI through OOMOL's official documentation, avoid piping remote scripts directly into a shell, and do not run the installer from an elevated/admin session unless you have independently confirmed it is necessary. The connector itself appears limited to reading Xweather data once the account is connected.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Installer Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 57
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The setup instructions pipe a remotely downloaded script directly into Bash. The payload is neither pinned to an immutable version nor checked using a cryptographic signature or trusted checksum. Although HTTPS protects the connection in transit under normal conditions, it does not guarantee that the server will always return the same audited content.

The effective code therefore remains outside the reviewed project and can change after publication. Compromise of the hosting service, vendor account, DNS resolution, or release pipeline could cause arbitrary attacker-controlled shell commands to be returned and executed.

Installing the CLI may support the Skill's weather-service functionality, but immediate execution of mutable network content exceeds the minimum mechanism necessary to perform that installation safely.

Attack Path

  1. The oo command is unavailable, causing the first-time setup instructions to apply.
  2. An attacker compromises or gains control over the installer delivery path or upstream publishing infrastructure.
  3. The URL returns a modified shell script containing attacker-controlled commands.
  4. curl sends the response directly to Bash without inspection or integrity verification.
  5. Bash executes the commands with the privileges of the user running the setup process.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. The resulting scope could include access to readable files and credentials, modification of user-owned data, installation of persistence within that user's permission boundary, and execution of further network requests. If the command is run f ...[truncated 75 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the pipe-to-shell command with installation through a trusted, version-pinned package manager or immutable release artifact.
  • Download the installer to a local file without executing it immediately.
  • Pin a specific release version and verify its cryptographic signature or a checksum obtained through a separately trusted channel.
  • Allow the user to inspect the downloaded file and require explicit approval before execution.
  • Document the installer's required permissions and instruct users not to run it with elevated privileges unless strictly necessary.
  • Prefer a reproducible installation command referencing an official release repository rather than a mutable generic installer URL.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installer Executed Directly by PowerShell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup instruction retrieves PowerShell source code from a mutable external URL and passes it directly to Invoke-Expression. No version pinning, signature validation, checksum verification, or local review occurs before execution.

Invoke-Expression interprets the downloaded response as PowerShell code in the current session. Consequently, control of the remote response is equivalent to control of commands executed by the user. HTTPS alone does not protect against compromise of the legitimate server, its deployment credentials, or its software supply chain.

While installation of the oo CLI is relevant to the declared connector functionality, executing an unverified response in memory is not the least-risk installation method.

Attack Path

  1. The oo command is unavailable on a Windows system.
  2. The user or agent follows the documented first-time setup instruction.
  3. An attacker compromises the installer host, publishing pipeline, or another component capable of controlling the HTTPS response.
  4. Invoke-RestMethod retrieves the attacker's PowerShell payload.
  5. The pipeline passes that payload directly to Invoke-Expression.
  6. The payload executes with the permissions and accessible session context of the invoking PowerShell process.

Impact Assessment

Exploitation enables arbitrary PowerShell command execution with the invoking user's privileges. An attacker could access files and credentials available to that account, alter user-owned resources, download additional payloads, or establish persistence where permissions allow. Execution from an administrator PowerShell session would expand the potential imp ...[truncated 49 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses to Invoke-Expression.
  • Use a trusted, version-pinned package source or download a specific immutable release artifact.
  • Require Authenticode signature validation or verification of a published cryptographic checksum before execution.
  • Save the installer locally so its origin, contents, and signature can be inspected.
  • Require explicit user approval before running the verified installer.
  • Run installation with standard-user privileges by default and document any narrowly scoped elevated operation that is genuinely required.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to execute a remote installation script via curl ... | bash, which is a classic supply-chain risk because downloaded code is executed immediately without verification. If the hosting source, transport, or distribution pipeline is compromised, arbitrary code could run on the user's machine under their shell context.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Xweather request" and "Whenever a task involves Xweather," which is an extremely broad activation condition. It does not define boundaries, exclusions, or negative examples, so ordinary mentions of Xweather could trigger the skill unnecessarily.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.