ClawHub
Back to skill

Security audit

Avoma

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent read-only Avoma connector, but its setup instructions include unsafe remote installer commands that could execute changing code on a user machine.

Review the setup path before installing. Prefer installing the oo CLI from a verified release or package manager with version and integrity checks, and only connect Avoma if you are comfortable routing Avoma meeting and transcription data through the OOMOL connector.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–67
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe remotely downloaded content directly into Bash or PowerShell. The downloaded installers are not pinned to a fixed release, saved for inspection, checked against a fixed cryptographic hash, or authenticated with a verifiable publisher signature before execution.

Consequently, the effective code executed by the instructions can change after the Skill has been reviewed. HTTPS protects data in transit but does not mitigate compromise of the remote server, CDN, DNS infrastructure, TLS termination environment, or vendor publishing credentials. It also does not establish that a subsequently modified installer remains equivalent to the version considered during this audit.

Installing the oo CLI may be relevant to the declared Avoma connector functionality, but immediate execution of mutable network content exceeds the minimum privilege and trust necessary to install that dependency safely.

Attack Path

  1. The user attempts to use the Skill on a system where the oo command is unavailable.
  2. The documented fallback directs the user or Agent to the remote installation command.
  3. An attacker compromises the installer endpoint or its publishing infrastructure and replaces the installer with a malicious payload.
  4. curl | bash or irm | iex executes the attacker-controlled response immediately, without an integrity or authenticity check.
  5. The payload runs with the privileges of the invoking user and can perform arbitrary actions available to that account.

Impact Assessment

Successful exploitation provides arbitrary code execu ...[truncated 786 chars]

Remediation
View remediation

Remediation Suggestions

Replace both pipe-to-shell installation commands with a verifiable installation process:

  1. Pin the CLI to a specific reviewed version rather than retrieving a mutable default installer.
  2. Download the release artifact to a local file without executing it.
  3. Verify a vendor-provided cryptographic signature using a separately distributed, trusted public key.
  4. Verify a fixed SHA-256 digest recorded in the Skill or another version-controlled source.
  5. Abort installation if either verification fails.
  6. Execute the verified installer explicitly only after displaying its source, version, destination, and expected permission requirements.
  7. Prefer a signed operating-system package or trusted package manager where available.
  8. Do not request administrator privileges unless a documented installation target strictly requires them; prefer a user-local installation.
  9. Document how users can uninstall the CLI and remove any files or configuration it creates.

At minimum, the instructions should follow a download, verify, and execute sequence rather than piping a network response directly into a command interpreter.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to install software via a remote script piped directly into a shell (curl ... | bash), which is a classic supply-chain and remote-code-execution risk. If the remote host, network path, or script content is compromised, arbitrary code would execute immediately on the user's machine without inspection or integrity verification.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase is overly broad: 'Use this skill for ANY Avoma request' can cause the agent to invoke this skill for all Avoma-related tasks without sufficient narrowing or user-intent validation. That increases the chance of inappropriate tool use, especially because the skill includes operational instructions and fallback setup steps that may lead to command execution in contexts where a simple informational response would be safer.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.