ClawHub
Back to skill

Security audit

Ambivo

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for operating Ambivo through OOMOL, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the setup path before installing. Prefer installing the oo CLI from a verified, versioned source and checking signatures or hashes instead of piping remote scripts directly into bash or PowerShell. For normal Ambivo use, confirm all create, update, and delete payloads before allowing the connector to run.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and pipes it directly into bash. The payload is executed without version pinning, checksum verification, cryptographic signature validation, or an opportunity for inspection.

HTTPS provides transport protection but does not guarantee that the hosted payload is safe. Compromise of the domain, hosting account, CDN, TLS endpoint, or release process could cause the same reviewed instruction to execute a different payload later. Although the OOMOL-branded source is relevant to the declared connector functionality, immediate remote script execution exceeds the minimum privilege necessary to document or install the CLI.

Attack Path

  1. The oo CLI is absent, causing the agent or user to follow the first-time setup instructions.
  2. An attacker compromises the remote script, its hosting infrastructure, or its publication process.
  3. curl retrieves the attacker-controlled response from the unchanged URL.
  4. The pipe passes the response directly to bash without integrity verification.
  5. The payload executes with all privileges available to the invoking account.

Impact Assessment

A malicious installation response could execute arbitrary commands, read or modify files accessible to the user, access locally available credentials, install additional software, alter shell configuration, or establish persistence. If the command is run from an elevated or highly privileged account, the payload could affect the entire system and other users.

The project contains no evidence that this command itself invokes sudo; therefore, system-wide privileges must not be assum ...[truncated 78 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe downloaded content directly into a shell.

  • Distribute a version-pinned release artifact through a verified package manager or official release repository.

  • Download the installer to a local file before execution.

  • Verify a publisher-provided cryptographic signature or a SHA-256 digest obtained through an independently trusted channel.

  • Allow the installer to be reviewed before it is executed.

  • Run installation with ordinary user privileges unless a documented operation specifically requires elevation.

  • Prefer a hardened sequence such as:

    bash
    curl --proto '=https' --tlsv1.2 -fL \
  -o oo-install.sh \
  'https://trusted.example/oo/releases/v1.2.3/install.sh'
printf '%s  %s\n' 'PINNED_SHA256' 'oo-install.sh' | sha256sum --check -
bash oo-install.sh

  • Replace the example URL and digest with an authenticated, immutable official release and its verified digest.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:68
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

irm retrieves mutable content from a remote endpoint and passes it directly to iex (Invoke-Expression). This causes the downloaded response to be interpreted as PowerShell code without version pinning, signature validation, hash verification, or prior inspection.

Because the effective code is controlled by the current server response, it can change after the Skill has been reviewed. HTTPS does not mitigate compromise of the publisher, hosting environment, release pipeline, or endpoint. Direct use of Invoke-Expression is unnecessary for installing a CLI and creates a high-risk arbitrary-code execution channel.

Attack Path

  1. The oo CLI is unavailable on a Windows system, prompting use of the documented setup command.
  2. An attacker modifies the remote PowerShell script or compromises its delivery infrastructure.
  3. Invoke-RestMethod downloads the modified response.
  4. The pipeline supplies the response directly to Invoke-Expression.
  5. The attacker-controlled PowerShell commands execute in the invoking user's security context.

Impact Assessment

The payload could access files and credentials available to the user, change PowerShell profiles, download additional executables, modify user-level configuration, or create persistence within the user's accessible scope. If PowerShell is running with administrative privileges, the payload could make system-wide changes.

The documented command does not itself request elevation; consequently, administrative access is conditional on the context in which the user executes it and is not established by the audited file alone.

Remediation
View remediation

Remediation Suggestions

  • Remove the Invoke-RestMethod | Invoke-Expression installation pattern.

  • Publish a versioned and immutable installer artifact signed with a trusted code-signing certificate.

  • Download the installer separately, verify its Authenticode signature and a publisher-provided cryptographic digest, and only then execute it.

  • Keep execution policy protections enabled and avoid advising users to bypass them.

  • Run installation without administrative privileges unless elevation is explicitly required and justified.

  • Prefer a hardened sequence such as:

    powershell
    Invoke-WebRequest `
  -Uri 'https://trusted.example/oo/releases/v1.2.3/install.ps1' `
  -OutFile '.\oo-install.ps1'

Get-AuthenticodeSignature '.\oo-install.ps1'
Get-FileHash '.\oo-install.ps1' -Algorithm SHA256
# Compare against an authenticated, publisher-provided digest before execution.
& '.\oo-install.ps1'

  • Document the expected signer identity and pinned digest so verification failures stop installation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software by piping a remote script directly into a shell, which creates a classic supply-chain and remote code execution risk. If the install endpoint, transport path, or upstream distribution is compromised, arbitrary code would execute immediately on the user's system without prior inspection or integrity verification.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says to use this skill for "ANY Ambivo request" and "Whenever a task involves Ambivo," which is an unusually broad activation condition for a markdown skill file. This can overlap with many ordinary Ambivo-related tasks without clarifying scope, exclusions, or negative examples, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.