ClawHub
Back to skill

Security audit

Agiled

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Agiled connector, but its setup instructions tell users to execute a remote installer directly, which warrants Review before installation.

Before installing, review the OOMOL CLI installation path carefully. Prefer a pinned, verifiable installer or official package-manager method, and avoid running the curl-to-bash or irm-to-iex commands automatically. Also confirm write or delete Agiled actions explicitly because this skill can change or remove CRM, project, and task data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:69
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69–73
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from cli.oomol.com and immediately pass them to a command interpreter. The Unix command pipes the HTTP response into Bash, while the Windows command passes the response to PowerShell's Invoke-Expression.

Neither instruction pins an installer version nor verifies a cryptographic signature or checksum before execution. HTTPS protects the connection in transit, but it does not protect users if the hosting infrastructure, publishing account, DNS configuration, or upstream deployment process is compromised. It also does not ensure that the script executed later is the same script that was available when this Skill was audited.

The instructions only recommend installation after an oo: command not found error, which limits when the path is reached, but does not mitigate the arbitrary-code-execution risk once installation occurs. Remote code execution exceeds the privileges needed merely to document or invoke the declared Agiled connector.

Attack Path

  1. An attacker compromises the remote installer host, its deployment credentials, DNS resolution, or another part of its publishing pipeline.
  2. The attacker replaces install.sh or install.ps1 with a malicious payload.
  3. A user or Agent encounters an oo: command not found error and follows the documented setup procedure.
  4. curl or Invoke-RestMethod retrieves the attacker-controlled content.
  5. Bash or Invoke-Expression executes that content immediately, without local inspection or integrity verification.
  6. The payload performs arbitrary actions u ...[truncated 935 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation instructions.
  2. Pin installation to a specific, reviewed CLI release rather than a mutable installer endpoint.
  3. Download the installer or binary to a local file without executing it automatically.
  4. Publish a cryptographic signature or strong checksum through an independently protected channel and require verification before execution.
  5. Prefer a trusted operating-system package manager or a verified release artifact from the official repository.
  6. Allow users to inspect the downloaded content before execution and document the files, permissions, and network access the installer requires.
  7. Run installation with ordinary user privileges wherever possible and avoid requesting administrative elevation unless a documented component requires it.
  8. For automated environments, mirror an approved, version-pinned artifact internally and enforce signature verification through deployment policy.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill includes a one-line installer that fetches a remote script and pipes it directly into a shell, which creates a supply-chain and arbitrary code execution risk. Because this appears in a setup path for command failure, an agent or user following the instructions could execute unreviewed code from a remote endpoint with local privileges.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description uses the phrase "for ANY Agiled request," which is extremely broad and lacks limiting conditions or exclusions. This can cause unintended invocation for ordinary mentions of Agiled without clarifying when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.