ClawHub
Back to skill

Security audit

CATS

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent CATS read-only connector, but its setup instructions include unverified remote installer commands that can execute arbitrary code on the user's machine.

Install only if you trust OOMOL's CLI distribution path and are comfortable with the skill accessing CATS data through your connected account. Prefer installing the oo CLI through a verified, versioned method with checksum or signature validation before using this skill.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote Shell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command downloads a mutable script from an external server and pipes it directly into Bash. The retrieved content is executed before the user or agent can inspect it, and the procedure provides no version pinning, cryptographic signature verification, checksum validation, or other mechanism that binds the executed payload to the version reviewed during this audit.

HTTPS protects the transport connection but does not establish that the hosted script will remain safe. Compromise of the hosting infrastructure, publisher account, domain, or release process could allow the installer to be replaced with arbitrary shell commands.

Installing the CLI may be necessary when it is unavailable, but immediate execution of an unverified remote script exceeds the minimum privileges and trust required for safe installation.

Attack Path

  1. A CATS action fails because the oo CLI is not installed.
  2. The agent or user follows the documented first-time setup instructions.
  3. curl retrieves the current contents of https://cli.oomol.com/install.sh.
  4. The downloaded bytes are passed directly to Bash without inspection or integrity verification.
  5. If the remote endpoint or its release infrastructure has been compromised, attacker-controlled commands execute with the privileges of the invoking account.
  6. Those commands can access data available to that account, alter local files and tools, install persistence, or transmit information to an attacker-controlled service.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user or agent running the installation command. The resulting scope can include readable local files, environment variable ...[truncated 205 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the pipe-to-shell installation command.
  • Distribute the CLI as a version-pinned package or immutable release artifact from an authenticated release channel.
  • Download the artifact to disk before execution so that it can be inspected.
  • Publish and require verification of a pinned SHA-256 checksum or, preferably, a cryptographic signature tied to a trusted publisher key.
  • Request explicit user approval before installing software.
  • Run the installer with ordinary user privileges unless a narrowly defined operation specifically requires elevation.
  • Document the expected files, installation paths, network destinations, and permissions.
  • Prefer a trusted operating-system package manager with version locking and signature verification where available.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:68
Finding

Unverified Remote PowerShell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The command uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and passes the response directly to Invoke-Expression (iex). This causes remote content to execute immediately in the current PowerShell context.

The instructions do not pin an installer version or verify an Authenticode signature, publisher identity, or cryptographic checksum. Consequently, the effective code can change after the Skill has been reviewed. HTTPS alone does not mitigate compromise of the provider, hosting account, domain, or release pipeline.

Installing the CLI can support the declared functionality, but executing unverified remote code is not the least-privilege or least-trust method of performing that installation.

Attack Path

  1. A Windows user or agent encounters an oo: command not found or equivalent failure.
  2. The documented setup command is executed.
  3. irm downloads the current content from https://cli.oomol.com/install.ps1.
  4. The response is sent directly to iex, with no opportunity for review or integrity validation.
  5. A maliciously replaced installer runs arbitrary PowerShell commands under the invoking account.
  6. The payload can inspect accessible data, alter the user environment, replace tools, establish persistence, or exfiltrate information.

Impact Assessment

Exploitation grants arbitrary PowerShell execution with the invoking account's permissions. A payload could access user files, environment variables, locally available credentials or tokens, CLI configuration, and CATS information processed on the system. If the shell is elevated, the payload may obtain system-wide reach, including modification of protected locations and persistence mechanisms.

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex pattern.
  • Provide a version-pinned installer artifact through an authenticated release channel.
  • Download the installer to a local file rather than evaluating the network response directly.
  • Require Authenticode signature validation against an expected publisher and verify a published, pinned cryptographic checksum.
  • Display the artifact source and intended changes and obtain explicit user approval before execution.
  • Run installation without administrative elevation unless a documented, narrowly scoped operation requires it.
  • Prefer a trusted Windows package manager that validates publisher signatures and supports version pinning.
  • Document expected installation paths, files, permissions, and outbound network access.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs users to install software via a remote script piped directly into a shell, which executes unreviewed code fetched at runtime. If the remote server, distribution path, or network path is compromised, this can lead to arbitrary code execution on the user's machine with the privileges of the shell session.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY CATS request," which is an extremely broad activation condition without examples or constraints. This can overlap with many ordinary requests mentioning CATS and does not clarify boundaries for when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.