ClawHub
Back to skill

Security audit

AppleDB

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent AppleDB read connector, but its setup instructions can execute an unverified remote installer and its action template is broader than the documented read actions.

Review this before installing if you do not already trust OOMOL's CLI distribution. Prefer installing the oo CLI through a verified, pinned, or package-manager path, and keep use limited to the four documented AppleDB read actions unless you explicitly approve another action.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
98% confidence
Finding
The skill instructs users to install software via `curl ... | bash`, which executes a remotely fetched script without prior verification. If the install endpoint, transport, or upstream distribution is compromised, this becomes immediate arbitrary code execution on the host running the skill.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest and description frame the skill as limited to AppleDB searching and reading, but the operational instructions allow invoking any connector action by arbitrary action name. That mismatch weakens least-privilege expectations and could let future write or destructive actions be executed through a skill users and agents reasonably trust as read-only.

Vague Triggers

Medium
Confidence
96% confidence
Finding
This manifest-style description defines activation in very broad terms and does not provide exclusions or narrower scope constraints. That can cause unintended invocation for loosely related AppleDB mentions rather than clearly delimited use cases.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill says untagged actions are safe reads, but the main execution flow tells the agent to inspect schema and run an arbitrary action before any meaningful check against the listed actions or safety tags. In practice, this makes the safety section advisory only and enables accidental execution of newly added or undocumented state-changing actions.

Static analysis

No suspicious patterns detected.