ClawHub
Back to skill

Security audit

Appcircle

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent read-only Appcircle connector, but its first-time setup tells users to execute unverified remote installer scripts directly in the shell.

Review the OOMOL oo CLI installer before using this skill. Prefer a pinned, signed, or checksum-verified installation path instead of piping a remote script directly into Bash or PowerShell. Once installed and connected, the listed Appcircle actions are read-only, but the skill depends on your OOMOL-connected account and durable local CLI authentication.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Shell Script Execution via curl and Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command downloads a mutable script from an external URL and pipes it directly into Bash. The instructions do not pin the script to a reviewed version or require validation through a cryptographic checksum or publisher signature. Although HTTPS protects the connection in transit, it does not ensure that the script remains identical to the version assessed during this audit.

If the hosting account, domain, web infrastructure, or release process is compromised, an attacker can replace the installation script. The substituted payload would then be executed immediately without being saved for review. Installing the CLI is related to the declared functionality, but immediate execution of an unverified remote script exceeds the minimum privilege and trust necessary to perform that installation safely.

Attack Path

  1. The oo CLI is unavailable on the user's system.
  2. The user or agent follows the first-time setup instructions.
  3. An attacker compromises the remote script's hosting account, delivery infrastructure, domain, or upstream publishing process.
  4. The curl command downloads the attacker-controlled script.
  5. The shell pipeline passes the response directly to Bash without integrity verification.
  6. Bash executes the payload with the privileges of the invoking user.

Impact Assessment

A successful attack obtains arbitrary code execution under the invoking user's account. The payload could read or modify files available to that account, access environment variables and locally stored credentials, alter shell configuration, install additional software, establish persistence where permissions permit, or retrieve and e ...[truncated 358 chars]

Remediation
View remediation

Remediation Suggestions

Replace the pipe-to-shell installation command with a verifiable installation procedure:

  1. Pin the CLI to a specific reviewed release version.
  2. Download the installer or binary to a local file without executing it.
  3. Obtain an expected SHA-256 or stronger digest through an independently authenticated channel, or use a valid publisher signature.
  4. Verify the checksum or signature before execution.
  5. Prefer a signed operating-system package or a trusted package manager where available.
  6. Display the exact file and command that will be executed and require explicit user approval.
  7. Run installation without administrative privileges unless a specific installation step demonstrably requires elevation.
  8. Document the expected files, network destinations, and system changes made by the installer.

A safer workflow is: download a version-pinned artifact, verify its publisher signature or documented checksum, inspect it, and then execute it as an unprivileged user.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote PowerShell Script Execution via Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell installation command retrieves a mutable script from an external server using Invoke-RestMethod (irm) and immediately evaluates it using Invoke-Expression (iex). No fixed release version, checksum, Authenticode signature verification, or opportunity for inspection is included.

This pattern makes the effective code dependent on the remote server's response at execution time. Consequently, the payload can change after the Skill has been reviewed. A compromise of the publisher, hosting service, domain, TLS termination infrastructure, or release pipeline could turn the documented installation step into an arbitrary code-execution mechanism.

Attack Path

  1. The oo CLI is unavailable on a Windows system.
  2. The user or agent follows the PowerShell first-time setup instructions.
  3. An attacker causes the remote endpoint to return a modified PowerShell payload.
  4. Invoke-RestMethod retrieves the attacker-controlled content.
  5. The pipeline sends that content directly to Invoke-Expression.
  6. PowerShell executes the payload in the user's current security context without integrity validation or prior inspection.

Impact Assessment

Exploitation provides arbitrary PowerShell execution with the privileges of the invoking process. The attacker could access files and credentials available to the user, alter PowerShell profiles, modify user-level configuration, download additional malware, or establish persistence where permissions allow. Execution from an elevated PowerShell session could permit system-wide modification and broader compromise.

No evidence in the supplied file establishes that the remote inst ...[truncated 148 chars]

Remediation
View remediation

Remediation Suggestions

Remove the irm ... | iex pattern and adopt a version-pinned, integrity-checked installation process:

  1. Download a specific signed release to a local file.
  2. Validate its Authenticode signature and trusted publisher identity, or compare a cryptographic checksum obtained through an independently authenticated source.
  3. Reject installation when signature or checksum validation fails.
  4. Allow the user to inspect the downloaded script before execution.
  5. Prefer a signed MSI, Microsoft Store package, WinGet manifest, or another trusted package mechanism.
  6. Avoid elevated PowerShell unless elevation is strictly required and clearly explained.
  7. Require explicit confirmation before executing the verified installer.
  8. Publish the installer's expected system changes and network activity.

The documentation should use separate download, verification, and execution commands rather than passing network content to Invoke-Expression.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a curl ... | bash installation command that downloads and immediately executes a remote script without integrity verification or pinning. If the remote host, transport path, or published install script is compromised, users may execute arbitrary code on their machine, and the skill context makes this more dangerous because it frames the command as a standard remediation step during setup.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says to use this skill for "ANY Appcircle request" and "Whenever a task involves Appcircle," which is an extremely broad trigger likely to overlap with many ordinary references to Appcircle. It does not provide constraints, exclusions, or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.