ClawHub
Back to skill

Security audit

Buttondown

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Buttondown, but its fallback setup can run an unverified internet installer on the user's machine.

Install only if you already trust OOMOL and are comfortable using its Buttondown connector. Avoid having an agent run the curl-to-bash or PowerShell iex installer automatically; prefer manually reviewing the official installation instructions and any installer contents before running them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:63-72
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

The first-time setup instructions execute mutable installation scripts retrieved from external URLs:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both commands pass remotely retrieved content directly to a command interpreter. The instructions do not pin a release, verify a checksum or cryptographic signature, or provide an opportunity to inspect the downloaded script before execution.

HTTPS authenticates and protects the network connection under normal conditions, but it does not ensure that the publisher's infrastructure, deployment pipeline, DNS, or current installer content has not been compromised. Because the effective code can change after this Skill has been reviewed, the package itself does not define or constrain the code that will execute.

Installing executable software is also broader than the minimum privileges required to invoke an already-installed Buttondown connector. Although installation is presented as a conditional fallback when oo is unavailable, the fallback permits arbitrary code execution with the privileges of the user running the shell.

Attack Path

  1. An attacker compromises the installer hosting infrastructure, release pipeline, DNS resolution, or the published installer itself.
  2. The Agent attempts to use the Skill on a system where the oo CLI is not installed.
  3. After the command-not-found error, the Agent follows the documented first-time setup procedure.
  4. curl or PowerShell retrieves the attacker-controlled response.
  5. The pipe passes that response directly to Bash or Invoke-Expression.
  6. The payload executes with the current user's privileges without integrit ...[truncated 916 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all pipe-to-shell and download-to-Invoke-Expression installation commands.
  2. Direct users to a versioned release artifact hosted through the vendor's documented release channel.
  3. Pin the expected CLI version rather than retrieving an unbounded latest installer.
  4. Publish and verify a SHA-256 checksum and, preferably, a cryptographic signature whose trusted public key is distributed independently.
  5. Download the artifact to disk first, validate its origin and integrity, and only then execute or install it.
  6. Require explicit user approval before installing software or making system-level changes.
  7. Prefer a trusted platform package manager with signed, versioned packages where available.
  8. Document the installer’s expected file-system changes, required permissions, and network destinations so users can assess its scope before installation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk: if the hosting endpoint, transport, or upstream release process is compromised, arbitrary code would run immediately on the user's machine without inspection or integrity verification. In this skill context, the danger is increased because the installation command is presented as an operational fallback step the agent may relay or execute when the CLI is missing.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Static analysis

No suspicious patterns detected.