ClawHub
Back to skill

Security audit

CentralStationCRM

Security checks for vulnerabilities and agentic risk

Overview

The skill’s CRM actions are clearly described, but its setup instructions tell users to run an unverified internet-downloaded installer directly in a shell.

Review the installer source and prefer an official package manager, pinned release, or checksum/signature-verified install before using this skill. For normal CRM use, only approve create, update, or delete actions after checking the exact target and payload.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:69
Finding

Unverified Remote Installer Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69–77
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The first-time setup instructions provide remote installation commands for macOS/Linux and Windows:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both commands retrieve mutable scripts from cli.oomol.com and execute them immediately in a local shell. The instructions do not pin a release or artifact, verify a cryptographic checksum or signature, or provide an inspection boundary between downloading and execution.

HTTPS protects data in transit when the endpoint and certificate infrastructure remain trustworthy, but it does not establish that the downloaded script is the same artifact that was security-reviewed. A compromised hosting account, web server, release pipeline, domain, or signing infrastructure—or an intentional later modification—could change the effective payload without changing this Skill.

Although installing the oo CLI supports the Skill's declared functionality, immediate execution of unverified remote code is not the minimum privilege or safest installation mechanism required to achieve that purpose.

Attack Path

  1. The oo command is unavailable, causing the first-time setup path to be used.
  2. The user or Agent runs the documented installation command.
  3. The shell retrieves the current script hosted at cli.oomol.com.
  4. The script is passed directly to Bash or PowerShell without local review or integrity verification.
  5. If the remote endpoint or delivery pipeline has been compromised, attacker-controlled commands execute with the privileges of the invoking account.
  6. Those commands can access user-readable data and credentials, modify files, install additional software, or estab ...[truncated 933 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove direct curl | bash and irm | iex installation patterns.
  2. Distribute the CLI through a trusted platform package manager or an official, versioned release repository.
  3. Pin the installer or binary to a specific immutable version rather than a mutable generic URL.
  4. Publish cryptographic checksums and, preferably, signed release artifacts with documented signature-verification steps.
  5. Download the artifact to disk without executing it, verify its integrity and authenticity, and only then run it as a separate explicit step.
  6. Present the exact artifact, expected publisher, requested permissions, and intended filesystem changes before asking the user for installation approval.
  7. Avoid privileged installation where possible; install within a user-scoped directory and request only the minimum permissions required.
  8. Apply equivalent download, pinning, signature, inspection, and approval controls to both the Bash and PowerShell installation paths.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This is dangerous because it executes unverified code from the network with the user's privileges, and any compromise of the host, CDN, DNS, TLS termination, or upstream script content could lead to arbitrary code execution. In this skill context, the risk is heightened because the installation step is embedded as operational guidance for recovering from a common failure mode.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

Static analysis

No suspicious patterns detected.