ClawHub
Back to skill

Security audit

Amilia

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Amilia connector, but its setup instructions include unverified remote installer commands that could run arbitrary local code.

Review this skill before installing. Its normal Amilia read actions are scoped and coherent, but avoid running the documented curl|bash or irm|iex setup commands unless you independently trust and verify OOMOL's installer source; prefer a pinned package or checksum/signature-verified install path.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:56
Finding

Unverified Remote Installer Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from an external server and pass them directly to Bash or PowerShell. The commands do not pin an installer version, validate a cryptographic signature or checksum, or allow inspection before execution.

The source domain is consistent with the declared OOMOL service, but this does not eliminate the security risk. The effective installer payload can change after the Skill has been audited. Compromise of the hosting service, publishing credentials, DNS/TLS path, or release pipeline could therefore convert these setup commands into arbitrary local code execution.

Installing the CLI may be relevant to the Skill's operation, but immediate execution of unverified remote content exceeds the minimum privilege and trust required to distribute it. A verified, version-pinned installation mechanism would provide the needed functionality with substantially less risk.

Attack Path

  1. The oo CLI is unavailable, and an attempted connector command returns oo: command not found.
  2. The Agent or user follows the documented first-time setup instructions.
  3. An attacker has compromised the external installer, its publishing pipeline, hosting infrastructure, or relevant delivery path.
  4. curl or PowerShell retrieves the attacker-controlled response.
  5. The shell immediately executes the response without integrity or authenticity verification.
  6. The payload runs with the privileges of the invoking account and can perform any operation available to that account.

Impact Assessment

Successful expl ...[truncated 942 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not pipe downloaded content directly into an interpreter.

  2. Distribute the CLI through a trusted package manager or a versioned official release artifact.

  3. Pin the exact installer or CLI version rather than retrieving a mutable latest script.

  4. Download the artifact to a local file before execution.

  5. Verify a vendor-provided cryptographic signature and a checksum obtained through an independently authenticated channel.

  6. Fail closed if signature, checksum, expected publisher, or version verification fails.

  7. Present the source, version, destination, and expected effects to the user and require explicit approval before installation.

  8. Run installation with ordinary user privileges unless a documented operation strictly requires elevation.

  9. Publish reproducible installer source and retain immutable release artifacts so the reviewed payload can be matched to the executed payload.

  10. Replace the current examples with a workflow equivalent to:

    bash
    curl -fLo oo-installer.sh \
  https://cli.oomol.com/releases/<pinned-version>/install.sh
echo '<trusted-sha256>  oo-installer.sh' | sha256sum -c -
less oo-installer.sh
bash oo-installer.sh

    A detached-signature verification workflow is preferable to relying solely on a checksum when practical.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software by piping a remote script directly into bash, which executes unverified code fetched at runtime. If the install endpoint, transport path, or hosting account is compromised, a user following the skill could execute arbitrary code on their machine with the privileges of their shell.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says to use this skill for "ANY Amilia request" and "Whenever a task involves Amilia," which is extremely broad and overlaps with many ordinary references to the service. It does not define boundaries, exclusions, or negative examples for when the skill should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.