ClawHub
Back to skill

Security audit

Bitquery

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for querying Bitquery through OOMOL, but its first-time setup tells the agent to run unverified remote installer scripts directly in a shell.

Review before installing. Use this skill only if you are comfortable routing Bitquery query payloads through OOMOL, and do not run the documented installer commands as written unless you independently trust and verify the installer source. Prefer an official, version-pinned, signed, or checksum-verified oo CLI installation path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:55
Finding

Unverified Remote Shell Script Execution via curl and Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 55
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction retrieves a shell script from a mutable external URL and passes it directly to Bash. The project does not pin a release version, verify a cryptographic checksum, validate a digital signature, or give the user an opportunity to inspect the downloaded script before execution.

Consequently, the effective code executed by this Skill is not contained in the audited package and can change after the audit. HTTPS protects the connection in transit under normal conditions, but it does not protect against compromise of the hosting account, web server, DNS infrastructure, certificate issuance process, or release pipeline.

Installing a CLI is relevant to the declared functionality, but executing an unauthenticated mutable payload exceeds the minimum privilege and trust necessary to perform installation safely.

Attack Path

  1. The oo CLI is unavailable, causing the user or agent to follow the first-time setup instructions.
  2. An attacker compromises or gains control over the installer endpoint, its delivery infrastructure, or its release pipeline.
  3. The attacker replaces install.sh with a malicious shell payload.
  4. curl downloads the modified payload without artifact integrity verification.
  5. The shell pipeline passes the response directly to Bash.
  6. The payload executes with all privileges available to the account that invoked the command.

Impact Assessment

Successful exploitation provides arbitrary command execution with the invoking user's privileges. The payload could access files and environment variables readable by that user, steal locally available credentials, alter shell configuration, ...[truncated 312 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell.
  • Publish versioned and immutable release artifacts through an official release channel.
  • Pin the installer or package to an explicit version.
  • Publish a SHA-256 or stronger digest through an independently protected channel and verify it before execution.
  • Prefer signed native packages and validate the package publisher's signature.
  • Download the artifact to a local file, verify its integrity, and allow inspection before running it.
  • Document the exact files, permissions, and system changes made by the installer.
  • Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation.

A safer workflow is:

bash
curl -fSLo oo-install.sh "https://cli.oomol.com/releases/VERSION/install.sh"
echo "EXPECTED_SHA256  oo-install.sh" | sha256sum --check -
less oo-install.sh
bash oo-install.sh

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote PowerShell Execution via Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Code Snippet:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Invoke-RestMethod retrieves mutable content from an external service and pipes it into Invoke-Expression. Invoke-Expression interprets the downloaded text as PowerShell code immediately. No version pinning, Authenticode signature validation, cryptographic digest verification, or manual review is required.

This design makes the remote endpoint part of the executable codebase while placing its contents outside the reviewed project. Any party able to alter the returned script can execute arbitrary PowerShell commands on the user's system.

Although installing the required CLI is related to the Skill's stated purpose, direct evaluation of unverified network content is not the least-privilege or least-trust installation method.

Attack Path

  1. The oo command is missing on a Windows system.
  2. The user or agent follows the documented PowerShell installation command.
  3. An attacker compromises the installer host, deployment pipeline, account, DNS path, or another trusted delivery component.
  4. Invoke-RestMethod retrieves attacker-controlled PowerShell source code.
  5. The pipeline forwards that source directly to Invoke-Expression.
  6. PowerShell executes the payload in the invoking user's security context.

Impact Assessment

Exploitation permits arbitrary PowerShell execution with the invoking user's privileges. A malicious installer could read accessible files and environment variables, extract development or cloud credentials, alter PowerShell profiles, establish user-level persistence, modify repositories, or stage further malware.

Administrator privileges are not explicitly requested in the documented ...[truncated 180 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the Invoke-RestMethod | Invoke-Expression installation pattern.
  • Distribute a version-pinned installer or package from an official release location.
  • Sign PowerShell scripts with a trusted Authenticode certificate and reject invalid or untrusted signatures.
  • Publish and verify a cryptographic hash before running the installer.
  • Save the script to disk and inspect it before execution.
  • Prefer a signed MSI, Microsoft Store package, WinGet package, or another package mechanism that validates publisher identity.
  • Clearly document whether administrative access is required and avoid elevation unless strictly necessary.

A safer workflow is:

powershell
Invoke-WebRequest "https://cli.oomol.com/releases/VERSION/install.ps1" -OutFile ".\install.ps1"
if ((Get-FileHash ".\install.ps1" -Algorithm SHA256).Hash -ne "EXPECTED_SHA256") {
    throw "Installer integrity verification failed"
}
Get-AuthenticodeSignature ".\install.ps1"
powershell -File ".\install.ps1"

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:3
Finding

Mandatory Third-Party Routing of Bitquery Requests

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3, 15, and 30
Vulnerability Type: Skill instruction hijacking and sensitive-data routing
Risk Level: Medium

Complete Code Snippet:

yaml
description: "Bitquery (bitquery.io). Use this skill for ANY Bitquery request — searching and reading data. Whenever a task involves Bitquery, use this skill instead of calling the API directly."
markdown
Operate **Bitquery** through your OOMOL-connected account. This skill calls the `bitquery` connector with the [oo CLI](https://github.com/oomol-lab/oo-cli); OOMOL injects credentials server-side, so you never handle raw tokens.
bash
oo connector run "bitquery" --action "<action_name>" --data '<json>' --json

Technical Analysis

The Skill contains a broad instruction requiring every Bitquery request to be handled through the OOMOL connector rather than allowing direct use of the Bitquery API. The connector command sends the supplied JSON request data to an external service.

Network transmission is necessary for remote Bitquery functionality, and the documentation identifies OOMOL as the intermediary. No evidence in the reviewed file establishes credential theft or transmission to an unrelated destination. However, the mandatory routing instruction changes how the agent handles all Bitquery tasks and introduces an additional data processor beyond Bitquery itself.

Depending on the submitted GraphQL request, transmitted JSON may contain wallet addresses, account identifiers, investigative targets, filtering criteria, or other confidential query context. The reviewed project does not document OOMOL's retention period, logging practices, access controls, data residency, or limits on secondary processing.

Attack Path

  1. A user submits a Bitquery-related request that includes confidential query parameters or investigative context.
  2. The broad Skill instruction causes the age ...[truncated 1117 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the mandatory “use this skill for ANY Bitquery request” instruction with narrowly scoped activation criteria.
  • Clearly disclose before execution that query payloads will pass through OOMOL rather than going directly to Bitquery.
  • Obtain user confirmation before transmitting confidential or personally identifying query parameters through the intermediary.
  • Document what request data and metadata OOMOL receives, how long it is retained, where it is stored, and who can access it.
  • Permit direct Bitquery API access when users require it or when organizational policy prohibits intermediary processing.
  • Minimize transmitted fields and redact secrets or unrelated sensitive information from connector payloads.
  • Provide documented controls for log deletion, retention limits, and enterprise data-processing requirements.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to install software via a remote script piped directly into a shell (curl ... | bash). This pattern is dangerous because it executes unverified code from the network without integrity checking, enabling supply-chain compromise or man-in-the-middle/server-side compromise to result in arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use this skill for "ANY Bitquery request" and "Whenever a task involves Bitquery," which is a very broad activation condition without clear scope boundaries or negative examples. That wording could overlap with many general research or data tasks that merely mention Bitquery, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.