ClawHub
Back to skill

Security audit

Ambient Weather

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for reading Ambient Weather data, but its first-time setup tells users to execute remote installer scripts directly without verification.

Review before installing. The data-access instructions are narrow and read-only, but do not run the one-line installer commands unless you trust OOMOL's installer source and are comfortable with it changing your local environment. Prefer an official, versioned installation method with checksum or signature verification if available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands retrieve mutable content from cli.oomol.com and immediately pass the response to a command interpreter. The downloaded scripts are not pinned to a version, inspected before execution, or verified using a cryptographic signature or expected digest.

HTTPS protects data in transit under normal conditions, but it does not establish that the retrieved script is the same artifact that was reviewed. A compromised hosting server, publishing account, certificate trust chain, or upstream release process could alter the effective payload at any time.

Installing the required oo CLI is related to the Skill's functionality, but executing an unverified remote response is not the minimum-privilege installation method. The scripts execute with all permissions available to the invoking Bash or PowerShell process. The Windows command has the same fundamental issue as the flagged curl | bash command because Invoke-RestMethod output is passed directly to Invoke-Expression.

The audit found no evidence that the current remote scripts are malicious. The vulnerability is that their contents are external, mutable, and executed without verification.

Attack Path

  1. A user invokes the Skill for an Ambient Weather operation.
  2. The oo command is unavailable, causing the documented first-time setup path to be used.
  3. The agent or user runs the applicable installation command.
  4. The command retrieves the current script from cli.oomol.com.
  5. Bash or PowerShell executes the response without checking its version, signature, ...[truncated 1198 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both direct execution patterns:
    • curl ... | bash
    • irm ... | iex
  2. Prefer an official operating-system package manager with publisher verification and a pinned package version.
  3. If standalone artifacts are necessary, download a versioned release to a local file without executing it.
  4. Publish and require verification of a cryptographic signature from a documented trusted key. At minimum, verify a SHA-256 digest pinned in the reviewed Skill rather than downloaded from the same location as the artifact.
  5. Abort installation if signature or digest verification fails.
  6. Allow inspection of the verified installer before execution and obtain explicit user approval.
  7. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation; do not request broad administrative access by default.
  8. Pin the installer and CLI to reviewed versions, and update the Skill only after reviewing new versions.
  9. Document the files, processes, and network endpoints affected by installation so users can assess the trust boundary and remove the CLI cleanly.
  10. Keep normal connector operations separate from installation. A missing CLI should produce a clear setup error rather than automatically executing downloaded code.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to install software by piping a remote script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk because any compromise of the hosting domain, transport, or installer content would result in arbitrary code execution on the machine running the command.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says to use this skill for "ANY Ambient Weather request" and "Whenever a task involves Ambient Weather," which is an unusually broad activation condition for a manifest/markdown file. It does not provide boundaries, exclusions, or negative examples to clarify when the skill should not be invoked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.