ClawHub
Back to skill

Security audit

Anchor Browser

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using Anchor Browser through OOMOL, but its first-time setup recommends executing unverified remote installer scripts.

Review this skill before installing. Its Anchor Browser connector instructions are clear, but install the oo CLI through a safer verified channel where possible, inspect any downloaded installer before running it, and avoid running installer commands from an elevated shell.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Shell Script Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 57
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a mutable remote HTTP response directly into Bash. Although HTTPS provides transport encryption and server authentication, the command performs no artifact version pinning, checksum verification, cryptographic signature validation, or local review before execution.

The effective code is therefore controlled by the remote endpoint at execution time and may differ from the content that existed when the Skill was audited. Compromise of the hosting service, publishing credentials, delivery infrastructure, or installer could turn this instruction into an arbitrary-code execution channel.

Installing the CLI may be necessary for the declared connector functionality, but executing an unverified remote script is not the minimum privilege or minimum-risk installation method required to achieve that purpose.

Attack Path

  1. The oo CLI is unavailable and an action fails with oo: command not found.
  2. The user or agent follows the first-time setup instructions.
  3. curl downloads the current content from https://cli.oomol.com/install.sh.
  4. The pipe sends that content directly to Bash without inspection or integrity verification.
  5. If the endpoint or delivery chain is compromised, attacker-controlled shell commands execute with the privileges of the invoking account.

Impact Assessment

A malicious installer could execute arbitrary commands with the current user's privileges. Depending on those privileges and the installer behavior, this could expose readable files and credentials, alter user configuration, install additional software, or create persistence. The reviewed file does not itself demonstrate pr ...[truncated 181 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation method.
  • Refer users to a pinned, versioned release from an authenticated distribution channel.
  • Download the installer as a file without executing it automatically.
  • Verify a publisher-provided cryptographic signature and a checksum obtained through a trusted, independent channel.
  • Allow the user to inspect the downloaded artifact and require explicit approval before execution.
  • Prefer a trusted operating-system package manager with signed metadata where available.
  • Run installation with ordinary user privileges unless a narrowly defined operation explicitly requires elevation.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote PowerShell Script Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The instruction uses Invoke-RestMethod (irm) to retrieve mutable content from a remote URL and pipes it directly to Invoke-Expression (iex). PowerShell evaluates the response as executable code immediately, without pinning a release or validating an Authenticode signature, checksum, or other integrity evidence.

As a result, the payload ultimately executed is determined by the remote endpoint at installation time rather than by the audited Skill package. HTTPS alone does not mitigate a compromised publisher account, hosting service, or installer source. While installation of the required CLI may be legitimate, immediate evaluation of unverified network content exceeds the minimum security exposure necessary for that installation.

Attack Path

  1. The oo CLI is unavailable on a Windows system.
  2. The user or agent follows the first-time setup instructions.
  3. Invoke-RestMethod retrieves the current response from https://cli.oomol.com/install.ps1.
  4. The pipeline passes the response directly to Invoke-Expression.
  5. If the remote source or delivery chain is compromised, attacker-controlled PowerShell commands execute in the invoking user's security context.

Impact Assessment

The remote script can perform any operation allowed to the current PowerShell process, including reading accessible files and credentials, modifying user configuration, downloading additional payloads, or establishing persistence. If launched from an elevated shell, the payload would inherit that elevated context. The reviewed Skill does not explicitly instruct users to elevate privileges and contains no confirmed embedded persistence or exfil ...[truncated 84 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Distribute a pinned, versioned installer through a trusted release channel.
  • Download the installer separately and verify its checksum and Authenticode signature before execution.
  • Display the source, version, publisher, and requested effects to the user before obtaining explicit installation approval.
  • Prefer a signed package distributed through a trusted Windows package manager where practical.
  • Avoid running the installer from an elevated PowerShell session unless elevation is demonstrably required for a specific operation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs the agent/user to install software by piping a remote script directly into a shell (curl ... | bash). This creates a supply-chain and remote-code-execution risk because any compromise of the hosting domain, transport, or script contents results in immediate arbitrary command execution on the local machine with no verification step.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Static analysis

No suspicious patterns detected.