ClawHub
Back to skill

Security audit

Apple Notary

Security checks for vulnerabilities and agentic risk

Overview

The skill is focused on Apple Notary, but its setup instructions run unverified remote installer scripts, so it should be reviewed before use.

Install only if you are comfortable with OOMOL mediating Apple Notary operations. Do not let an agent run the curl | bash or irm | iex setup commands automatically; prefer a pinned, verified installer or inspect and validate the script first. For submit_software, confirm the exact file hash and treat returned AWS credentials as sensitive until they expire.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding
Unverified Remote Installer Executed Through Bash## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes content retrieved from a mutable external URL directly into Bash. The script is executed before the user or Agent can inspect it, and the instruction provides no version pinning, cryptographic checksum, or signature verification. HTTPS protects the connection under normal conditions, but it does not establish that the retrieved script is the same script that was reviewed. Compromise of the hosting account, web server, DNS or certificate infrastructure, or the installer publication process could cause arbitrary commands to be returned and executed. Installing the required CLI is relevant to the Skill's declared functionality, but immediate execution of an unverified remote script is not the minimum privilege or minimum-risk mechanism necessary to perform that installation. ### Attack Path 1. An Agent attempts to use the Skill and encounters an `oo: command not found` error. 2. Following `SKILL.md`, it runs the documented `curl` pipeline. 3. The current contents of `https://cli.oomol.com/install.sh` are downloaded at execution time. 4. A compromised or malicious installer response is passed directly to Bash without inspection or integrity validation. 5. The payload executes arbitrary shell commands with the privileges of the account running the command. 6. Those commands could access readable files and credentials, alter user configuration, install additional software, or establish persistence. Such follow-on behavior is possible but is not itself present in the audited file. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's privileges. ...[truncated 479 chars]
Remediation
## Remediation Suggestions - Remove the direct `curl | bash` installation pattern. - Prefer a signed operating-system package or a reputable package manager with package-signature and integrity validation. - Pin the CLI to a specific reviewed release rather than retrieving a mutable installer endpoint. - Download the artifact without executing it, then verify a vendor-published cryptographic checksum and, preferably, a detached signature whose trust root is distributed separately. - Display or document the expected installer behavior and request explicit user approval before executing downloaded code. - Execute installation with ordinary user privileges unless a specific, documented operation requires elevation. - Fail closed when integrity or signature verification fails.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding
Unverified Remote Installer Executed Through PowerShell## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and passes the response directly to `Invoke-Expression` (`iex`). This treats externally controlled response content as executable PowerShell source. No fixed release, checksum, Authenticode signature check, or other integrity control is required before execution. Although HTTPS ordinarily protects transport confidentiality and integrity, it does not prevent a compromised publisher or hosting environment from replacing the installer after review. CLI installation supports the Skill's functionality, but evaluating an unverified network response as PowerShell code exceeds the minimum-risk behavior required to install that CLI. ### Attack Path 1. A Windows user or Agent encounters an `oo: command not found` condition. 2. It follows the first-time setup instruction in `SKILL.md`. 3. PowerShell retrieves the current response from `https://cli.oomol.com/install.ps1`. 4. If the hosting or publication chain has been compromised, the response contains attacker-selected PowerShell commands. 5. `Invoke-Expression` evaluates those commands immediately without prior inspection or cryptographic verification. 6. The commands run in the current PowerShell security context and can access user data, credentials, configuration, and other resources available to that account. ### Impact Assessment Exploitation permits arbitrary PowerShell execution with the invoking account's privileges. A payload could read or modify user files, obtain accessible credentials, change PowerShell profiles or other configuration, download additional p ...[truncated 406 chars]
Remediation
## Remediation Suggestions - Remove the `irm | iex` pattern and never evaluate an uninspected network response directly. - Distribute the CLI through a signed Windows package or a package manager that verifies publisher identity and artifact integrity. - Pin a specific release and download it to a local file before execution. - Validate a vendor-published SHA-256 checksum and require a valid Authenticode or detached cryptographic signature. - Keep signature trust material independent from the server delivering the installer. - Present the intended installation steps and request explicit approval before executing the verified installer. - Run without administrative privileges unless elevation is strictly required and separately approved. - Abort installation on any download, checksum, signature, or publisher-validation failure.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The description says to use this skill for ANY Apple Notary request and instead of calling the API directly, which is an overly broad trigger that can cause the agent to route all Apple Notary-related tasks through this skill without sufficient task-specific scrutiny. In a security-sensitive domain that can return temporary AWS credentials and perform write actions, broad auto-invocation increases the chance of unintended execution or overexposure of sensitive operational data.

Static analysis

No suspicious patterns detected.