ClawHub
Back to skill

Security audit

Apollo

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Apollo connector, but its first-time setup tells users or agents to execute unverified remote installer scripts.

Review before installing. Normal Apollo searches and enrichment calls are read-oriented and purpose-aligned, but do not run the documented remote installer commands unless you trust the OOMOL CLI distribution path and have verified the installer through a safer channel.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Shell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Remote payload retrieval and execution through curl | bash
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and passes its response directly to Bash. No version is pinned, and no cryptographic signature, checksum, or expected file content is verified before execution.

Although the URL belongs to the service identified by the skill documentation, the effective code is controlled remotely and can change after the skill has been reviewed. Static analysis of this project therefore cannot determine what commands will execute when a user follows the instruction. Compromise of the hosting infrastructure, deployment pipeline, domain resolution, or signing environment could turn this documented installation step into an arbitrary-code-execution channel.

This behavior is not required for the skill's normal Apollo search and enrichment operations. The document already states that the CLI should normally be installed and limits this command to first-time setup, but it still recommends a high-risk execution mechanism that exceeds the minimum privileges needed merely to invoke the connector.

Attack Path

  1. The oo CLI is absent, causing an attempted connector action to fail with oo: command not found.
  2. The user or agent follows the documented fallback installation instruction.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is streamed directly into Bash without local inspection or integrity verification.
  5. If the remote response has been maliciously modified, attacker-controlled shell commands execute immediately.
  6. Those commands can access or modify resources available to the account that launched Bash.

...[truncated 666 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation pattern.
  • Prefer a trusted operating-system package manager or a version-pinned release artifact.
  • Download the installer to a local file rather than streaming it into a shell.
  • Publish a cryptographic checksum and a signed release manifest through an independently verifiable channel.
  • Verify the checksum and signature before permitting execution.
  • Allow the user to inspect the downloaded script and require explicit approval before running it.
  • Pin the installer to a reviewed release version instead of a mutable generic URL.
  • Document the exact files, permissions, and network endpoints used by the installer.
  • Ensure installation runs without administrative privileges unless a specific operation strictly requires them.
  • Keep agent behavior limited to presenting safe installation guidance; the agent should not automatically install software after a failed connector command.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote PowerShell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Remote payload retrieval and execution through Invoke-RestMethod | Invoke-Expression
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

PowerShell aliases irm and iex refer to Invoke-RestMethod and Invoke-Expression. The command retrieves content from a mutable external URL and immediately evaluates it as PowerShell code. It does not pin an installer version, validate an Authenticode signature, compare a cryptographic digest, save the content for review, or constrain the commands that the downloaded response may execute.

The source domain is consistent with the OOMOL service described by the skill, but domain consistency alone does not provide payload integrity. The effective code can change after review, and compromise of the remote host or its software supply chain would provide an execution path on users' Windows systems.

Installing a required CLI can be legitimate first-time setup, but immediate evaluation of an unverified network response is not necessary for that purpose and violates least-privilege and secure installation principles.

Attack Path

  1. A Windows user encounters an oo: command not found failure.
  2. The user or agent follows the documented PowerShell installation command.
  3. Invoke-RestMethod retrieves the current content of https://cli.oomol.com/install.ps1.
  4. The pipeline sends that content directly to Invoke-Expression.
  5. A maliciously altered response executes as PowerShell without integrity verification or prior inspection.
  6. The payload performs actions available to the PowerShell process and the invoking Windows account.

Impact Assessment

Exploitation would allow arbitrary PowerShell execution under the invoking user's security context. A malicious response could read ...[truncated 701 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex instruction.
  • Distribute the CLI through a trusted Windows package manager or a version-pinned release package.
  • Download the PowerShell installer to disk before execution.
  • Require a valid Authenticode signature from an expected publisher and fail closed if verification fails.
  • Publish and verify a cryptographic checksum through an independently authenticated release manifest.
  • Present the downloaded script for inspection and obtain explicit user approval before execution.
  • Invoke the verified script using an explicit file path rather than Invoke-Expression.
  • Document the installer's expected filesystem, registry, permission, and network effects.
  • Run installation as a standard user wherever possible and request elevation only for narrowly defined operations.
  • Do not allow the agent to execute installation automatically in response to a missing-command error.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via a remote script piped directly into the shell (curl ... | bash), which is a well-known supply-chain and arbitrary code execution risk. If the hosting domain, script, transport, or distribution pipeline is compromised, a user following the documented recovery path could execute attacker-controlled code on their machine.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Apollo request" and "Whenever a task involves Apollo," which is a very broad trigger that overlaps with many possible user intents. It does not define boundaries, exclusions, or negative examples for when the skill should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.