ClawHub
Back to skill

Security audit

CastingWords

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for using CastingWords through OOMOL, but its first-time setup tells users to execute remote installer scripts directly without integrity verification.

Review the installer path before installing. Prefer an official package manager, a pinned release, or a downloaded installer with checksum or signature verification, and confirm any transcription submission payload because it changes CastingWords account state.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installation Script Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The first-time setup instructions pipe a remotely downloaded installation script directly into Bash. The effective code is not included in the reviewed project and can change independently after the skill has been audited. No version pinning, cryptographic signature validation, checksum verification, or opportunity for local inspection is provided.

Installing the oo CLI is relevant when the required command is unavailable, but immediate execution of mutable remote content is not the minimum safe mechanism needed to install it. Although the URL is presented as OOMOL's CLI domain, the reviewed file provides no mechanism to establish the integrity or authenticity of the returned script beyond HTTPS transport.

Attack Path

  1. An action fails because the oo command is unavailable.
  2. The agent or user follows the documented first-time setup procedure.
  3. curl retrieves the current content served by https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without being saved, inspected, pinned, or cryptographically verified.
  5. If the hosting account, delivery infrastructure, DNS path, TLS trust chain, or remote script is compromised, attacker-controlled shell commands execute immediately.
  6. Those commands operate with the privileges of the account running the installation command.

Impact Assessment

A compromised installation response could execute arbitrary commands with the invoking user's privileges. This may permit access to files and environment variables available to that user, credential theft, filesystem modification, installation of additional payloads, or persistence attempts. The exact scope depends on th ...[truncated 101 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer an official package manager or a pinned CLI release from a verifiable repository.
  • Download the installer to a local file rather than piping it directly into a shell.
  • Publish and verify a cryptographic signature or a checksum obtained through a separately authenticated channel.
  • Pin the expected release version so that the executed artifact cannot change silently after review.
  • Allow the downloaded script to be inspected before execution.
  • Run installation with an unprivileged account and avoid sudo unless a documented installation step strictly requires it.
  • Document the expected files, network destinations, and system changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote Installation Script Executed Through PowerShell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup instruction uses Invoke-RestMethod (irm) to retrieve a mutable remote PowerShell script and sends the response directly to Invoke-Expression (iex). This causes downloaded text to be interpreted as PowerShell code immediately.

The project does not pin a script version or require Authenticode signature, checksum, or publisher verification. Consequently, the executed payload is controlled by whatever content the external endpoint returns at installation time and can differ from what was available during this audit.

Attack Path

  1. An action fails on Windows because the oo command is unavailable.
  2. The agent or user follows the documented PowerShell setup command.
  3. Invoke-RestMethod downloads the current content from https://cli.oomol.com/install.ps1.
  4. The pipeline passes that content directly to Invoke-Expression.
  5. No local review, version pinning, signature validation, or checksum verification occurs before execution.
  6. If the remote script or its delivery infrastructure is compromised, attacker-supplied PowerShell commands execute in the current user's session.

Impact Assessment

A malicious response could run arbitrary PowerShell operations with the invoking user's privileges. Potential effects include reading accessible files and environment variables, stealing locally available credentials, modifying user configuration, downloading further payloads, or attempting persistence. If the user launches PowerShell with administrative privileges, the resulting scope may extend to system-wide modification.

Remediation
View remediation

Remediation Suggestions

  • Replace the irm ... | iex pattern with a pinned and verifiable installation package.
  • Download the PowerShell installer to disk before execution.
  • Require a valid Authenticode signature from an expected publisher or verify a published cryptographic checksum through a separately authenticated channel.
  • Pin the expected CLI release and download URL.
  • Permit inspection of the script before execution.
  • Run installation in a non-administrative PowerShell session unless elevated access is demonstrably necessary.
  • Prefer a trusted Windows package manager with package identity and integrity validation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses review and integrity verification, so a compromised distribution server, DNS/TLS interception failure, or malicious script update could lead to arbitrary code execution on the user's machine. In this skill context, the risk is elevated because the installation step is presented as an operational fallback inside a trusted workflow, increasing the chance an agent or user executes it reflexively.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Static analysis

No suspicious patterns detected.