ClawHub
Back to skill

Security audit

Ashby

Security checks for vulnerabilities and agentic risk

Overview

This Ashby skill is mostly a scoped read-only connector, but its setup instructions include running downloaded installer scripts directly, which warrants review before installation.

Before installing, confirm you trust OOMOL as a connector provider for Ashby data and avoid running the remote installer commands blindly. Prefer a verified package, pinned release, or manually inspected installer, and remember the connected account can read candidate and job information through Ashby.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installer Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable script from an external URL and pipes it directly into Bash. The script is neither pinned to a reviewed version nor verified using a cryptographic signature or checksum. Consequently, the code that users execute can differ from the content available when the Skill was audited.

Installation of the oo CLI supports the declared connector functionality, but direct pipe-to-shell execution is not the minimum privilege or safest installation mechanism required. It prevents meaningful inspection before execution and grants the downloaded script all privileges available to the invoking user.

Trust in the apparent vendor domain does not eliminate the risk. Compromise of the hosting service, publishing account, DNS resolution, TLS infrastructure, or installer deployment pipeline could turn this instruction into an arbitrary-code-execution channel.

Attack Path

  1. An Ashby operation fails because the oo CLI is unavailable.
  2. The user or agent follows the documented first-time setup instruction.
  3. curl retrieves the current contents of https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without inspection or integrity verification.
  5. If the remote installer or its delivery path has been compromised, attacker-controlled commands execute with the invoking user's privileges.
  6. Those commands can access user-readable data, alter files, install additional software, or establish persistence subject to the account's permissions.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user running the install ...[truncated 328 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation pattern.
  • Prefer a trusted operating-system package manager or a signed, versioned release package.
  • Pin installation artifacts to an explicit reviewed version rather than a mutable installer endpoint.
  • Download the artifact to disk as a separate step so it can be inspected before execution.
  • Verify a publisher signature or a pinned SHA-256 checksum obtained through an independent trusted channel.
  • Require explicit user approval before installing software or running an installer.
  • Run installation with standard user privileges and avoid requesting administrative privileges unless a documented component strictly requires them.
  • Document the files, network access, and configuration changes performed by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote Installer Executed Through PowerShell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction uses Invoke-RestMethod through its irm alias to retrieve a mutable PowerShell script and sends the response directly to Invoke-Expression through iex. Invoke-Expression interprets the downloaded text as PowerShell code immediately. There is no pinned release, cryptographic signature validation, checksum verification, or opportunity to review the script before execution.

Although installing the required CLI is related to the Skill's functionality, immediate evaluation of remotely controlled text exceeds the minimum safe mechanism needed to perform that installation. The effective payload remains under the control of the remote delivery infrastructure after the Skill package has been reviewed.

Attack Path

  1. An Ashby operation fails on Windows because the oo CLI is not installed.
  2. The user or agent follows the documented PowerShell setup command.
  3. Invoke-RestMethod downloads the current response from https://cli.oomol.com/install.ps1.
  4. The response is passed directly to Invoke-Expression.
  5. A compromised server, publishing account, DNS route, or delivery pipeline supplies attacker-controlled PowerShell.
  6. PowerShell executes the payload with the current process token, allowing actions within the invoking user's authorization scope.

Impact Assessment

Successful exploitation yields arbitrary PowerShell execution with the invoking user's privileges. An attacker could read accessible credentials and documents, alter user configuration, download additional payloads, tamper with development tools, or create persistence where permissions allow. Execution from an elevated PowerShe ...[truncated 50 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Distribute the CLI through a trusted package manager or a signed and versioned installer.
  • Pin the installer to a specific reviewed release.
  • Download the installer separately and validate its Authenticode signature or a pinned cryptographic checksum before execution.
  • Avoid Invoke-Expression; invoke a verified local installer through an explicit command instead.
  • Require clear user confirmation before software installation.
  • Perform installation without administrative elevation unless it is demonstrably necessary.
  • Publish the installer's expected filesystem, registry, and network changes so users can assess its privilege requirements.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote-code-execution risk: if the install endpoint, transport, or upstream distribution is compromised, arbitrary code would run immediately on the user's machine without prior inspection.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says to use this skill for "ANY Ashby request," which is an extremely broad activation cue and does not define boundaries or exclusions. Because this is a manifest file, such wording can overlap with many routine mentions of Ashby and lacks negative examples or scope constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.