ClawHub
Back to skill

Security audit

AltText.ai

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing AltText.ai through OOMOL, but its first-time setup recommends running unverified remote installer scripts directly in a shell.

Review the OOMOL CLI installation path before installing. Prefer official, version-pinned, signed, or checksum-verified installation instructions instead of piping downloaded scripts directly into bash or PowerShell. Once the CLI is installed, the skill's AltText.ai actions are clearly scoped and destructive operations require explicit confirmation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Shell Installer Executed Through curl and bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:61
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The first-time setup instructions pipe a remotely retrieved shell script directly into bash. The effective executable payload is not contained in the reviewed Skill and can change after the Skill has been audited. The command does not pin an installer version, verify a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded file before execution.

HTTPS protects transport in ordinary conditions but does not establish that the mutable script itself is safe. Compromise of the hosting infrastructure, domain, DNS resolution, publishing account, or TLS trust path could cause arbitrary attacker-controlled commands to be delivered. Installing the CLI is only a conditional setup activity and is not required for normal AltText.ai connector operations after installation; automatic remote execution therefore exceeds the minimum privileges needed for the Skill's primary functionality.

Attack Path

  1. The oo CLI is absent, causing an oo: command not found failure.
  2. The Agent or user follows the setup command in SKILL.md.
  3. An attacker who controls or compromises the remote installer delivery path modifies https://cli.oomol.com/install.sh.
  4. curl retrieves the altered response and pipes it directly to bash.
  5. The malicious script executes without integrity verification or prior inspection.

Impact Assessment

The downloaded script receives arbitrary command-execution capability under the account that launches the command. It could read or modify files accessible to that account, steal local credentials or session material, alter development tools, install persistence, or download additional payloads. If the command is launched ...[truncated 185 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash execution pattern.
  • Direct users to a pinned release artifact from an authenticated official release channel.
  • Download the installer to a local file rather than piping it into a shell.
  • Publish and verify a cryptographic signature or a checksum obtained through an independently protected channel.
  • Display the resolved version, source, and expected digest before execution.
  • Require explicit user approval before installing software or executing a downloaded installer.
  • Run installation with ordinary user privileges unless elevation is demonstrably necessary.
  • Prefer a reputable platform package manager with version pinning and package-signature validation where available.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote PowerShell Installer Executed Through Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:65
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup command retrieves mutable PowerShell content with Invoke-RestMethod (irm) and immediately evaluates it with Invoke-Expression (iex). The remotely hosted script is outside the audited package and can be replaced after review. No release version is pinned, and no Authenticode signature, detached signature, or cryptographic digest is validated before execution.

Because iex interprets the response directly as PowerShell code, anyone who gains control of the remote content-delivery path can convert the documented installation flow into arbitrary local code execution. This installation behavior is ancillary to the declared AltText.ai connector functionality and is unnecessary once the CLI is present.

Attack Path

  1. The oo CLI is unavailable on a Windows host.
  2. The Agent or user follows the PowerShell setup instruction.
  3. An attacker compromises the remote installer, its publishing account, hosting infrastructure, DNS path, or another trusted delivery component.
  4. irm downloads attacker-controlled PowerShell source.
  5. The pipeline passes the response to iex, which executes it immediately without integrity or publisher verification.

Impact Assessment

The payload can perform any operation allowed to the current PowerShell process, including accessing user files, extracting credentials available to the account, changing local configuration, replacing tools, establishing persistence, or fetching further malware. Execution from an administrator PowerShell session could result in system-wide modification or compromise. Administrative execution is not explicitly required by the audited instructions, so elevated impact depends ...[truncated 23 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pattern and never evaluate an HTTP response directly.
  • Download a version-pinned installer to disk and require explicit approval before running it.
  • Require a valid Authenticode signature from the expected publisher, or verify a signed manifest and cryptographic checksum before execution.
  • Fail closed when signature, publisher identity, version, or digest validation does not succeed.
  • Prefer a signed package distributed through a reputable Windows package manager or an authenticated release channel.
  • Run with standard-user privileges by default and request elevation only for narrowly defined operations that require it.
  • Document the files, commands, network destinations, and system changes made by the installer.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification and makes execution depend entirely on the security of the remote host, transport chain, and any upstream compromise; if the install script is tampered with, it results in arbitrary code execution on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Static analysis

No suspicious patterns detected.