ClawHub
Back to skill

Security audit

Ambee

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Ambee data-access behavior is mostly coherent, but its fallback setup tells users to run unverified remote installer scripts.

Review the installer path before use. Prefer installing the oo CLI from a verified, pinned, or signed source instead of running the provided pipe-to-shell commands directly. Once the CLI is already installed and connected, the skill’s Ambee actions are read-only lookups through OOMOL.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a mutable remote script directly into Bash. Although the URL uses HTTPS and an OOMOL-branded domain, the command does not pin a script version or verify a cryptographic signature or checksum. The effective code is therefore controlled by the remote server and may change after the Skill has been reviewed.

The instruction is presented as a fallback when the oo command is unavailable, rather than as part of every action. Nevertheless, installing the CLI does not require immediate execution of unverified network content. This approach exceeds the minimum privileges and trust necessary for the Skill's declared Ambee lookup functionality.

Attack Path

  1. A user attempts to use the Skill on a system where the oo CLI is unavailable.
  2. The Skill directs the user or agent to execute the documented installation command.
  3. curl retrieves the current contents of https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without being saved, reviewed, version-pinned, or integrity-checked.
  5. If the vendor infrastructure, domain, CDN, DNS resolution, or script publication process is compromised, attacker-controlled shell commands execute immediately.
  6. The payload can operate with all permissions held by the invoking account.

Impact Assessment

A malicious installation response could execute arbitrary commands with the invoking user's privileges. Potential effects include reading or modifying accessible files, stealing local credentials and session material, installing additional payloads, altering command-line tools, and accessing network services available to the user. If the command is run by an administrator ...[truncated 299 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Link to a versioned release rather than a mutable installation endpoint.
  • Download the installer or binary to a local file without executing it automatically.
  • Publish and require verification of a vendor signature or a SHA-256 checksum delivered through an independently protected channel.
  • Allow the user to inspect the downloaded artifact before execution.
  • Prefer a trusted operating-system package manager with explicit version pinning where available.
  • Run installation with ordinary user privileges unless a documented installation step strictly requires elevation.
  • Document the files, directories, and configuration changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows installation instruction obtains a mutable PowerShell script with Invoke-RestMethod (irm) and immediately executes its response using Invoke-Expression (iex). It does not pin a release, validate an Authenticode signature, compare a cryptographic checksum, or provide an opportunity to inspect the downloaded code.

HTTPS protects the connection in transit under normal conditions, but it does not establish that future content at the endpoint is identical to audited content. Compromise of the publishing account or remote delivery infrastructure could replace the installer while leaving the documented command unchanged.

This installation mechanism is only a fallback for a missing CLI, but immediate execution of unverified content is not necessary for the Skill's read-only geocoding and air-quality functions and introduces host-level risk beyond those functions.

Attack Path

  1. A user attempts to use the Skill on Windows without the oo CLI installed.
  2. The documented fallback command is run in PowerShell.
  3. irm downloads the current response from https://cli.oomol.com/install.ps1.
  4. The response is sent directly to iex without local review or integrity verification.
  5. A compromised endpoint or delivery chain supplies attacker-controlled PowerShell.
  6. PowerShell executes the payload in the current process with the invoking user's permissions.

Impact Assessment

A substituted payload could execute arbitrary PowerShell operations, access files and credentials available to the user, modify the user's profile or tools, download further malware, and communicate with external services. Execution from an elevated PowerShell sessi ...[truncated 348 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the irm | iex pattern with a staged download and verification process.
  • Reference a specific, immutable CLI release.
  • Require validation of an Authenticode signature from the expected publisher or a securely published SHA-256 checksum.
  • Save the script locally and permit inspection before it is executed.
  • Prefer a trusted Windows package manager using a pinned package version.
  • Avoid administrator execution unless a narrowly documented installation operation requires it.
  • Publish the installer's expected filesystem, registry, environment, and network changes.
  • Fail closed when signature or checksum verification is unavailable or unsuccessful.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to execute a remote installation script via curl ... | bash, which directly pipes network content into a shell without verification. If the hosting endpoint, transport, or upstream distribution is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Ambee request" and "Whenever a task involves Ambee," which is a very broad activation condition for a markdown skill file. It does not define narrower trigger boundaries or exclusion examples, so ordinary references to Ambee-related tasks could unintentionally invoke the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.