ClawHub
Back to skill

Security audit

Breathe

Security checks for vulnerabilities and agentic risk

Overview

The Breathe read functions fit their purpose, but setup can run unverified software with broader effects on your agent’s installed skills.

Review and install the CLI separately before use. Its documented OO_SKILLS_SYNC_DISABLED setting can prevent automatic skill synchronization; see the [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Connect only the intended Breathe account and consider OOMOL’s access to employee data. The downloaded installers and hosted connector implementation were not verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The supplied command installs or bootstraps software through a remotely fetched shell script; it does not demonstrate searching or reading Breathe data. No connection between this installer and the declared Breathe functionality is shown, so this is an undeclared capability rather than an established supporting implementation detail. The downloaded script's further behavior cannot be determined from the supplied chunk.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The curl-to-bash pipeline executes the current contents served by the remote endpoint without first verifying or reviewing them. HTTPS protects transport but does not protect against a compromised publisher or distribution infrastructure, allowing attacker-controlled code to access local data and credentials with the user's privileges; this is the same underlying installation risk identified by SQP-2.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Fallback setup executes remotely downloaded installation scripts without a security warning.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

The fallback instructs immediate execution of remotely downloaded shell or PowerShell code without a version pin, integrity verification, or explicit approval for running the installer. A compromised distribution endpoint or malicious installer update could execute arbitrary code with the invoking user's privileges; triggering setup only when the CLI is missing limits exposure but does not establish trust in the downloaded code.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources