ClawHub
Back to skill

Security audit

BetterContact

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent BetterContact connector, but its first-time setup tells users or agents to run unverified remote installer scripts directly in a shell.

Review this skill before installing. It appears intended to use BetterContact through OOMOL, but avoid running the provided curl-to-bash or PowerShell iex installer commands unless you independently trust and verify the OOMOL CLI installer. Confirm any submit_enrichment payload because it sends lead data to the BetterContact connector and may consume account credits.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:55
Finding

Unverified Remote Installation Scripts Executed Directly by Shell Interpreters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable content from an external URL and immediately execute it with Bash or PowerShell. The effective code is therefore not contained in the reviewed Skill and can change at any time after the audit.

HTTPS provides transport protection but does not ensure that the retrieved installer is immutable or trustworthy. The instructions do not pin an installer version, validate a cryptographic checksum or signature, save the script for inspection, or constrain the privileges available to it. The PowerShell form uses Invoke-Expression, while the Bash form pipes the response directly into an interpreter; both prevent meaningful review before execution.

Installing the required CLI can be legitimate, but direct remote-script execution exceeds the minimum mechanism necessary to accomplish that task. A version-pinned and cryptographically verified package or locally inspected installer would provide the same functionality with less supply-chain exposure.

Attack Path

  1. An attacker compromises the installer hosting infrastructure, DNS/account controls, deployment pipeline, or an authorized publisher account.
  2. The attacker replaces install.sh or install.ps1 with a malicious payload while retaining the documented URL.
  3. A user or agent encounters an oo: command not found error and follows the first-time setup instructions.
  4. curl or Invoke-RestMethod retrieves the attacker's current payload.
  5. Bash or Invoke-Expression executes the payload immediately without integrity verification or prior inspect ...[truncated 951 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both direct execution patterns:
    • Do not pipe curl output into Bash.
    • Do not pass downloaded content to PowerShell Invoke-Expression.
  2. Pin installation instructions to a specific, immutable CLI release and artifact.
  3. Download the artifact to a local file without executing it.
  4. Publish a trusted SHA-256 digest or cryptographic signature through an independently protected release channel.
  5. Verify the digest or signature before execution and abort on any mismatch.
  6. Allow the user to inspect the downloaded installer and obtain explicit approval before running it.
  7. Prefer a reputable package manager with signed packages and version pinning where available.
  8. Run installation with ordinary user privileges unless elevated privileges are demonstrably required; clearly disclose any files, directories, or system settings the installer will change.
  9. Document a safe installation sequence, for example: download, verify, inspect, then execute the verified local artifact.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software via a remote script pipeline (curl ... | bash), which executes code fetched from the network without verification. If the host, transport, or served script is compromised, this can lead to arbitrary code execution on the user's machine under the current user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description says to use this skill for ANY BetterContact request and instead of calling the API directly, which is broad enough to cause over-invocation whenever BetterContact is merely mentioned. This can route unrelated or underspecified tasks into a privileged connector flow, increasing the chance of unintended data access or writes, especially because the skill exposes a write-capable action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.