ClawHub
Back to skill

Security audit

Bark

Security checks for vulnerabilities and agentic risk

Overview

The Bark integration is mostly coherent, but its setup instructions include unverified remote installer scripts that could execute arbitrary code.

Install only if you are comfortable with OOMOL's Bark connector and handle CLI setup manually. Avoid running the pasted curl|bash or irm|iex commands unless you have independently reviewed the installer source and trust the publisher; prefer a pinned, signed, or package-manager installation path.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Shell Script Execution via curl and Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command downloads mutable content from an external URL and pipes it directly into Bash. The project does not pin a release, verify a cryptographic signature or checksum, save the script for inspection, or otherwise authenticate the payload independently of HTTPS.

HTTPS protects the network transport but does not establish that every future version of the hosted script is safe. Compromise of the hosting infrastructure, publishing account, or upstream build process—or an unsafe future modification to the script—would allow the effective payload to change after this Skill has been reviewed.

This behavior is only presented as a fallback when oo is not installed, so it is not necessary for routine Bark operations. Moreover, arbitrary Bash execution exceeds the normal Bash(oo *) tool scope declared by the Skill.

Attack Path

  1. The Agent attempts a Bark operation and receives an oo: command not found error.
  2. It follows the first-time setup instructions in SKILL.md.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without local inspection or integrity verification.
  5. If the remote script or its delivery infrastructure has been compromised, attacker-controlled commands execute with the privileges of the user running the Agent.

Impact Assessment

The downloaded script obtains arbitrary code execution under the invoking user's account. Subject to that account's permissions, it could read or alter local files, access credentials available to the process, install software, modify shell configuration, initiate network connections, or establish persistence.

The reposit ...[truncated 307 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell.
  • Pin installation instructions to a specific, immutable CLI release.
  • Download the installer or release artifact to a local file before execution.
  • Publish and verify a cryptographic signature from a documented release key, or at minimum verify a release-specific SHA-256 checksum obtained through an independently protected channel.
  • Prefer a trusted operating-system package manager with package signing and explicit version selection.
  • Permit users to inspect the downloaded artifact before running it.
  • Keep installation outside the Skill's routine execution path and require explicit user approval before invoking any installer.
  • After installation, continue limiting operational commands to the declared oo CLI scope.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote PowerShell Script Execution via Invoke-RestMethod

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

irm retrieves a mutable PowerShell script from an external server and sends its contents directly to iex (Invoke-Expression). This executes the response as PowerShell code without version pinning, signature validation, checksum verification, local inspection, or an auditable package artifact.

Because the executable payload is hosted outside the reviewed project, it can change independently of the Skill. A compromised publishing account, hosting service, upstream release process, or unsafe future script revision could consequently turn this setup command into an arbitrary-code execution channel.

The command is described as a first-time fallback rather than a requirement for ordinary Bark connector operations. Invoking unrestricted PowerShell also exceeds the minimum privileges represented by the Skill's normal Bash(oo *) command restriction.

Attack Path

  1. A Windows user or Agent encounters an unavailable oo command.
  2. The first-time setup instructions are followed.
  3. Invoke-RestMethod downloads the current contents of https://cli.oomol.com/install.ps1.
  4. The response is immediately evaluated by Invoke-Expression.
  5. If an attacker controls or compromises the delivered response, arbitrary PowerShell commands run in the invoking user's security context.

Impact Assessment

A malicious installer response could perform any action allowed to the invoking Windows account, including reading or changing user files, accessing credentials exposed to the process, modifying PowerShell profiles or user startup settings, installing software, and communicating with external systems. If the shell is elevated, the resulting impact could extend to ...[truncated 299 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex installation pattern.
  • Distribute a versioned and signed PowerShell installer or package.
  • Download the artifact separately and validate its Authenticode signature and release-specific checksum before execution.
  • Prefer a signed package distributed through a trusted Windows package manager.
  • Require explicit user approval before installation and clearly identify the downloaded version, publisher, and requested privileges.
  • Run installation without elevation unless system-wide installation is strictly required.
  • Keep setup separate from routine Skill operations and retain the narrow oo command scope after installation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification, review, and pinning, so a compromised server, CDN, network path, or upstream script could lead to arbitrary code execution on the host running the skill.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Static analysis

No suspicious patterns detected.