ClawHub
Back to skill

Security audit

API2PDF

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a straightforward API2PDF connector, but its setup guidance includes unverified remote script execution and its safety labels understate that markdown content is sent to an external PDF service.

Review this skill before installing. Use it only when you are comfortable sending the markdown content to API2PDF through OOMOL, and avoid running the documented pipe-to-shell installer commands unless you separately verify the installer source and integrity.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:55
Finding

Unverified Remote Shell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 55
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes content retrieved from an external URL directly into Bash. The script is not pinned to a specific version, saved for inspection, or validated using a cryptographic signature or trusted checksum before execution. Consequently, the effective code can change after the Skill has been reviewed.

Although the domain appears associated with the declared OOMOL CLI, transport encryption alone does not establish that the downloaded script is immutable or safe. Compromise of the hosting service, publication pipeline, DNS or TLS infrastructure, or an authorized publisher account could replace the installer with arbitrary commands.

Installing software is also unnecessary for the Skill's normal runtime operation when the CLI is already present. Automatically executing an installer following a command-not-found error exceeds the minimum privileges needed to invoke the declared API2PDF connector.

Attack Path

  1. The user or agent attempts to use the Skill without the oo CLI installed.
  2. The resulting command-not-found error causes the first-time setup instructions to be followed.
  3. An attacker compromises or gains control over the installer endpoint or its release infrastructure.
  4. The endpoint returns a modified shell script containing attacker-controlled commands.
  5. curl streams the response directly to Bash without validation or review.
  6. Bash executes the payload with the privileges of the invoking user.

Impact Assessment

Successful exploitation provides arbitrary command execution in the invoking user's security context. The payload could read or modify files accessible to that account, steal locally available credentials or ...[truncated 270 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash execution pattern.
  • Direct users to a trusted package manager or a versioned official release artifact.
  • Pin the CLI to a reviewed release version rather than a mutable installer URL.
  • Download the artifact to disk without executing it.
  • Validate a publisher-provided cryptographic signature or an independently delivered SHA-256 checksum.
  • Display the source, destination, version, and expected changes before installation.
  • Require explicit user approval before executing any downloaded installer.
  • Run installation with ordinary user privileges unless a documented operation strictly requires elevation.
  • Keep installation outside the Skill's routine execution path and retain the current behavior of attempting setup only after a genuine command-not-found failure.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote PowerShell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell instruction retrieves a mutable remote script with Invoke-RestMethod and immediately evaluates it with Invoke-Expression. No version pinning, signature verification, checksum validation, local inspection, or integrity check occurs between retrieval and execution.

This creates a direct remote code-execution channel whose effective payload is controlled by the current response from the external server. HTTPS protects data in transit under normal conditions, but it does not mitigate compromise of the hosting account, build and publication pipeline, endpoint content, or trusted TLS infrastructure.

The use of Invoke-Expression is especially dangerous because all returned text is interpreted as PowerShell code in the current process. Installing the CLI is not required for normal Skill execution when it is already installed and therefore falls outside the minimum runtime privileges needed for PDF conversion.

Attack Path

  1. The user or agent invokes the Skill on Windows without the oo CLI installed.
  2. A command-not-found error leads to the first-time setup instruction.
  3. An attacker compromises the installer endpoint or an upstream publication mechanism.
  4. Invoke-RestMethod retrieves attacker-controlled PowerShell content.
  5. The pipeline passes that content directly to Invoke-Expression.
  6. PowerShell executes the payload with the current process and user privileges.

Impact Assessment

Exploitation permits arbitrary PowerShell command execution as the invoking user. An attacker could access files and credentials available to that account, change user configuration, replace or wrap local tools, download further payloads, or ...[truncated 255 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the Invoke-RestMethod | Invoke-Expression pattern.
  • Prefer a trusted Windows package manager or a versioned installer obtained from an official release channel.
  • Pin the exact CLI release and download it to a local file before execution.
  • Require a valid Authenticode signature from the expected publisher and validate a securely published cryptographic checksum.
  • Present the verified artifact, publisher, version, and intended changes to the user.
  • Obtain explicit user approval before starting installation.
  • Avoid Invoke-Expression; invoke only a verified, locally stored installer using a constrained command.
  • Do not request administrator privileges unless a documented installation requirement makes them strictly necessary.
  • Keep installation separate from routine connector execution.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remotely fetched script without verification. If the install endpoint, transport, or upstream distribution is compromised, this becomes an immediate arbitrary code execution path on the host running the skill.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest and description frame the skill as limited to 'searching and reading data', but the only documented action performs content conversion/generation. This mismatch can mislead an orchestrating agent into treating the action as low-risk read-only behavior, reducing safeguards or confirmation before sending user content to an external service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger text says to use this skill for 'ANY API2PDF request', which is overly broad and can cause the skill to activate in situations beyond its narrow documented capability. Overbroad routing increases the chance of unintended use, including applying this skill to unsupported or higher-risk actions without proper scrutiny.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The safety section says untagged actions are reads, but markdown_to_pdf is not a read operation; it submits content for processing and produces a new artifact. That incorrect safety labeling can cause the agent to run the action automatically without adequate consent, disclosure, or review of sensitive content being transmitted externally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.