ClawHub
Back to skill

Security audit

Auth0 Management

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Auth0 Management, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the setup path before installing. Prefer a signed or package-manager installation for the oo CLI, verify release integrity where possible, and do not allow an agent to run the remote installer automatically. Also confirm Auth0 scopes carefully and require explicit approval for role or permission changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The setup instructions download mutable scripts from an external server and immediately execute the returned content using Bash or PowerShell. Neither installation path pins a specific release, verifies a cryptographic checksum or digital signature, nor gives the user an opportunity to inspect the downloaded script before execution. The installer is not included in the audited project, so its effective behavior cannot be determined from the reviewed artifact. Even if `cli.oomol.com` is the declared vendor domain, the executed payload can change after this Skill has been reviewed. Compromise of the hosting service, deployment pipeline, vendor account, or network trust path could therefore turn these documented installation commands into an arbitrary-code-execution channel. Installing the CLI may be necessary for the declared connector functionality, but piping unverified network content directly into a command interpreter exceeds the minimum privilege and trust required to perform that installation. The Windows command has the same security property as the Unix command: `irm` retrieves the response and `iex` evaluates it as PowerShell code. ### Attack Path 1. The `oo` CLI is absent, causing an action to fail with `oo: command not found`. 2. The agent or user follows the first-time setup instructions in `SKILL.md`. 3. The shell requests `install.sh` or `install.ps1` from `cli.oomol.com`. 4. An attacker who has compromised the remote host, rel ...[truncated 1389 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk because any compromise of the host, TLS trust chain, delivery path, or script content would cause arbitrary code to run immediately on the user's machine without verification.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Static analysis

No suspicious patterns detected.