ClawHub
Back to skill

Security audit

Autom

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Autom connector, but its setup instructions include unverified remote installer commands that could execute arbitrary code if followed.

Review the installer commands before installing. Prefer an official, versioned installer or package-manager flow with checksum/signature verification, and do not let an agent run the curl|bash or irm|iex setup automatically. Routine Autom read actions through an already installed oo CLI appear aligned with the skill's purpose.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installer Execution Through Shell Pipelines

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions download mutable scripts from cli.oomol.com and pass their contents directly to a command interpreter. Neither command pins an installer version, verifies a cryptographic checksum or signature, nor provides an opportunity to inspect the downloaded code before execution.

Although the hostname is consistent with the declared OOMOL publisher, reliance on HTTPS and domain ownership alone does not establish the integrity of the script over time. Compromise of the distribution server, publishing process, DNS or TLS infrastructure, or the installer itself could cause these documented commands to execute attacker-controlled code. The effective payload can also change after the Skill has been reviewed.

Installing the CLI is only a conditional first-time setup operation rather than a routine requirement for each Autom request. Direct execution of an unverified installer therefore exceeds the minimum behavior needed to run the declared read-only connector actions. The project contains no local installer implementation that could otherwise be audited.

Attack Path

  1. The oo CLI is absent and an attempted Autom operation produces a command-not-found error.
  2. The user or agent follows the first-time setup instructions in SKILL.md.
  3. An attacker compromises or replaces the content returned by https://cli.oomol.com/install.sh or install.ps1, or compromises infrastructure involved in its delivery.
  4. curl or irm retrieves the attacker-controlled content.
  5. The pipeline immediately supplies that content to bash or `Invoke-E ...[truncated 887 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both pipe-to-interpreter installation commands.
  2. Direct users to a version-pinned release from the publisher's verifiable official release repository.
  3. Download the installer or binary to a local file without executing it immediately.
  4. Publish and verify a SHA-256 or stronger checksum over a trusted, independently delivered channel.
  5. Prefer cryptographic signature verification using a documented publisher key.
  6. Allow inspection of the downloaded script before executing it.
  7. Prefer a reputable platform package manager where packages are signed and versions can be pinned.
  8. Run installation without administrator privileges unless a documented installation step strictly requires elevation.
  9. Keep installation explicitly user-driven and separate from normal Skill execution; the Skill should never install software automatically after a failed connector command.
  10. Document the exact files, directories, network destinations, and permissions used by the installer so users can assess its privilege requirements.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software via curl ... | bash, which executes a remote script directly from the network without prior verification or integrity checking. If the distribution server, DNS, TLS trust chain, or upstream script is compromised, this becomes an immediate arbitrary code execution path on the host running the agent.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction to use this skill for "ANY Autom request" is an overly broad trigger that can cause the agent to invoke the skill whenever Autom is merely mentioned, even if the user did not intend tool use. In an agent setting, broad auto-routing increases the chance of unintended external data access, unnecessary credentialed calls, and bypass of more context-appropriate handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.