ClawHub
Back to skill

Security audit

AgentMail (QQ)

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing AgentMail (QQ), but its first-time setup includes unverified remote installer commands that could run arbitrary code.

Review the installer path before using this skill. Prefer installing the oo CLI from a verified, version-pinned source with checksum or signature validation, and require explicit approval before sending mail or deleting messages.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Installer Download and Immediate Shell Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe remotely retrieved content directly into Bash or PowerShell. The downloaded installers are mutable remote resources: the exact code executed can change after the Skill has been reviewed. Neither command pins a release version, validates a cryptographic checksum, verifies a digital signature, nor gives the user an opportunity to inspect the script before execution.

The download domain is consistent with the declared OOMOL service, and installation is only recommended when the oo command is unavailable. Nevertheless, transport security and apparent domain ownership do not establish artifact integrity. A compromise of the hosting infrastructure, publishing account, DNS or TLS trust chain could turn these commands into an arbitrary-code-execution channel.

Installing the required CLI is relevant to the declared connector functionality, but immediate execution of an unverified remote script exceeds the minimum privileges necessary. The CLI should instead be installed from a pinned and independently verifiable artifact. The audit found no evidence that the Skill itself harvests credentials or transmits information to an unrelated destination; its ordinary connector network communication is consistent with its AgentMail functionality.

Attack Path

  1. The oo CLI is absent, causing the agent or user to consult the first-time setup instructions.
  2. An attacker compromises the remote installer, its publication pipeline, or an applicable network trust component.
  3. The attacker serves a modified install.sh or `install.p ...[truncated 912 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation patterns.
  2. Direct users to a version-pinned release artifact hosted in the vendor's official release repository.
  3. Download the artifact without executing it, then verify a vendor-published SHA-256 or stronger checksum through an independent trusted channel.
  4. Prefer cryptographic signature verification using a documented vendor signing key. Pin and document the expected signer identity.
  5. Require users to inspect or explicitly approve the verified installer before execution.
  6. Document the files, directories, environment changes, network access, and permissions required by the installer.
  7. Run installation without administrative privileges unless a specific operation demonstrably requires elevation.
  8. Prefer a reputable platform package manager with signed, versioned packages where available.
  9. If automated installation is unavoidable, pin both the installer version and digest, fail closed on verification errors, and never execute an unverified HTTP response directly from a pipeline.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote-code-execution risk because any compromise of the hosting domain, TLS termination, distribution pipeline, or the script itself would execute arbitrary code on the machine without inspection or integrity verification. In this skill context, the danger is elevated because the content is operational guidance for an agent, increasing the chance the unsafe command is executed automatically during setup or error recovery.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.