ClawHub
Back to skill

Security audit

Avochato

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Avochato use, but its setup instructions include unverified remote installer commands that can execute code on the user's machine.

Review the first-time setup before installing. Prefer a verified package or checksum/signature-checked installer for the oo CLI, and confirm exact payloads before sending messages or changing Avochato contacts.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installer Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61 and 65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download remotely hosted installation scripts and pass their responses directly to Bash or PowerShell. Neither command pins an installer version nor verifies a cryptographic signature or checksum before execution.

HTTPS protects the connection in transit but does not establish that the current server-side script is identical to the artifact that was reviewed. The effective payload can change after this Skill is audited. Compromise of the hosting account, domain, delivery infrastructure, or installer publishing pipeline could therefore turn these documented setup commands into an arbitrary-code-execution channel.

Installing the oo CLI is relevant when the required tool is absent, and the document limits this operation to first-time setup after a command-not-found failure. Nevertheless, immediate execution of an unverified network response exceeds the minimum privilege and trust necessary to install a CLI. A pinned and independently verified package would provide the required functionality with substantially less risk.

Attack Path

  1. A user or agent attempts to use the Skill on a system without the oo CLI.
  2. The action fails with an oo: command not found error.
  3. Following SKILL.md, the user or agent invokes the applicable installation command.
  4. The command retrieves the current response from cli.oomol.com.
  5. Bash or PowerShell executes that response immediately, without local review, version pinning, checksum validation, or signature verification.
  6. If the remote source or delivery chain has been compromised, attacker-controlle ...[truncated 842 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all direct pipe-to-shell and download-to-Invoke-Expression installation instructions.
  2. Distribute the CLI through a trusted package manager or a versioned official release.
  3. Pin the installer or package to a specific immutable version.
  4. Publish a SHA-256 checksum and, preferably, a cryptographic signature for each release.
  5. Require users to download the artifact to a local file and verify its checksum or signature before execution.
  6. Document the files, permissions, and system changes made by the installer.
  7. Recommend installation under an unprivileged account and explicitly discourage sudo, administrator shells, or elevation unless a documented operation strictly requires it.
  8. If an installer script remains necessary, use a pattern such as:
bash
curl -fSLo oo-install.sh "https://example.invalid/releases/vX.Y.Z/install.sh"
echo "<trusted-sha256>  oo-install.sh" | sha256sum --check
less oo-install.sh
bash oo-install.sh
  1. Provide an equivalent pinned download, signature verification, and separate execution process for Windows rather than using irm ... | iex.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs users to install the CLI via curl ... | bash, which executes a remotely fetched script without prior verification. If the distribution server, network path, or script content is compromised, this can lead to arbitrary code execution on the host running the command.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Avochato request" and "Whenever a task involves Avochato," which is a very broad trigger without constraints or exclusion examples. This can overlap with many routine mentions of Avochato and does not clearly define when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.