ClawHub
Back to skill

Security audit

CallRail

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent CallRail reader, but its setup tells users to run an unverified remote installer and its action scope is broader than a read-only skill should be.

Install only if you trust OOMOL's installer source and are comfortable connecting CallRail data through OOMOL. Prefer installing the oo CLI through a verified, versioned method first, and treat this skill as suitable for listed read actions rather than unrestricted CallRail changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–64
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe network responses directly into Bash or PowerShell. The referenced payloads are not pinned to immutable versions, downloaded for review, or verified with a cryptographic signature or checksum before execution. Consequently, the code executed during installation can differ from the content available when the Skill was reviewed.

HTTPS provides transport security but does not guarantee payload immutability or protect against compromise of the hosting service, DNS infrastructure, TLS endpoint, or vendor publishing pipeline. Although cli.oomol.com is consistent with the declared OOMOL service, immediate execution of mutable remote content still creates a remote code-execution and supply-chain risk.

Installing the required CLI may support the declared CallRail integration, but unrestricted execution of a downloaded installer exceeds the narrow Bash(oo *) capability needed for routine connector operations. The installer receives the invoking user's shell privileges and is not constrained to CallRail access.

Attack Path

  1. A user or agent attempts a CallRail operation when the oo CLI is unavailable.
  2. Following the Skill instructions, it requests install.sh or install.ps1 from cli.oomol.com.
  3. An attacker compromises the hosting endpoint, publishing pipeline, DNS/TLS path, or another mechanism controlling the returned content.
  4. The shell receives the response through the pipe and executes it immediately, without integrity verification or review.
  5. The malicious installer performs arbitrary ...[truncated 802 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash and irm | iex installation patterns.
  2. Prefer a trusted platform package manager or a version-pinned release artifact from an official repository.
  3. Publish cryptographic checksums and signed release metadata, and verify them before execution.
  4. Download the installer to a local file rather than piping it directly to a shell.
  5. Require explicit user approval after displaying the source, version, destination, and verification result.
  6. Pin the installer to an immutable version instead of a mutable generic URL such as install.sh.
  7. Run installation with the lowest practical privileges and avoid administrative elevation unless a documented step strictly requires it.
  8. Keep CLI installation outside automated Skill execution where possible; the Skill should normally invoke only the already-installed oo command.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly without prior verification, pinning, or integrity checking. If the distribution endpoint, network path, or hosting account is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest and description claim this skill is for searching and reading data, but the execution instructions allow the operator to supply any connector action name dynamically. That creates a capability mismatch: if the connector later exposes write or destructive actions, a user or downstream agent could invoke them under a skill that appears read-only, undermining trust boundaries and approval logic.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The invocation guidance says to use this skill for ANY CallRail request, which is overly broad and can cause the skill to activate for tasks beyond its safe or intended scope. In combination with dynamic action execution, that increases the chance an agent routes sensitive or state-changing requests through a skill presented as read-focused.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The safety section asserts that untagged actions are reads and that only tagged actions mutate state, but the skill simultaneously instructs operators to inspect and run any live connector action by name. Because the listed actions are not a hard limit, hidden or future write actions could be executed without being listed or tagged here, causing unsafe assumptions by agents and users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.