ClawHub
Back to skill

Security audit

CallerAPI

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says for CallerAPI, but its setup instructions include high-impact remote script execution without verification.

Review the oo CLI installation path before installing. Prefer a signed or checksum-verified installer if available, and be aware that using this skill sends CallerAPI lookup inputs through the OOMOL connector and can retrieve your CallerAPI account email and credit balance.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:56
Finding

Unverified Remote Installer Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–60
Vulnerability Type: Remote payload retrieval and arbitrary code execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions download mutable scripts from external URLs and immediately execute them with bash or PowerShell's Invoke-Expression. Neither command pins a release version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded payload before execution.

The domains are consistent with the declared OOMOL service, and the instructions only recommend installation after an oo: command not found error. However, HTTPS and a recognizable domain do not establish the integrity of the script itself. Its effective behavior can change at any time after this Skill has been audited. Compromise of the installation service, hosting infrastructure, DNS resolution, or TLS trust chain could turn these documented commands into an arbitrary-code execution channel.

Direct remote execution is not the minimum privilege or safest mechanism necessary to install the CLI. The PowerShell variant presents the same underlying risk as the curl | bash variant.

Attack Path

  1. A CallerAPI operation fails because the oo CLI is unavailable.
  2. The agent or user follows the documented first-time setup instructions.
  3. The shell retrieves the current installer from cli.oomol.com.
  4. A compromised or malicious endpoint returns attacker-controlled shell code.
  5. bash or Invoke-Expression executes the response immediately without integrity validation.
  6. The payload runs with the privileges of the invoking account and can perform arbitrary operations available to that account.

Impact Assessment

Su ...[truncated 1114 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove both direct pipe-to-shell installation commands.
  2. Prefer a trusted, platform-native package manager or a version-pinned release artifact from the vendor's documented repository.
  3. Download the installer or binary to a local file without executing it:
    • Use a fixed release URL rather than a mutable install.sh or install.ps1 endpoint.
    • Disable unexpected redirects or explicitly validate the final download host.
  4. Publish and require verification of a pinned SHA-256 or stronger digest obtained through an independent trusted channel.
  5. Prefer publisher-signed artifacts and verify the signature against a documented, pinned signing identity.
  6. Allow the downloaded script to be inspected before execution.
  7. Execute installation with an unprivileged account and request elevation only for narrowly defined operations that require it.
  8. Document the files, directories, environment changes, and network destinations used by the installer.
  9. For connector operations, inform users before transmitting third-party phone numbers and document the destination, purpose, retention policy, and applicable privacy requirements.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install the CLI by piping a remote script directly into a shell (curl ... | bash), which executes unaudited code fetched at runtime. If the install endpoint, transport, hosting, or supply chain is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description says to use this skill for "ANY CallerAPI request" and "whenever a task involves CallerAPI," which is an overly broad trigger that can cause the agent to invoke the skill for casual mentions or contexts where direct use is unnecessary. In an agentic system, broad routing language increases the chance of unintended tool execution and unnecessary exposure of connected third-party data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.