ClawHub
Back to skill

Security audit

Chorus

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent read-only Chorus connector, but its setup instructions include running remote installer scripts directly in a shell without verification.

Use this skill only if you trust OOMOL and the oo CLI installation channel. Prefer installing oo through a verified package or downloaded installer with checksum/signature validation instead of piping remote scripts directly into bash or PowerShell. After oo is installed and Chorus is connected, the documented connector actions are limited to reading Chorus data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Installer Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–64
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions retrieve mutable scripts from an external URL and execute them immediately through Bash or PowerShell. Neither command saves the installer for inspection nor verifies a pinned version, cryptographic checksum, or digital signature before execution.

The installers are not included in the reviewed project, so their effective behavior cannot be established through static inspection. Even if the domain is currently legitimate, compromise of its hosting infrastructure, publication process, DNS resolution, TLS trust chain, or installer endpoint could substitute arbitrary commands after this Skill has passed review.

Installing the CLI may be necessary when oo is unavailable, but executing unverified network content directly exceeds the minimum privilege and trust required for that purpose. A safer installation flow can authenticate a fixed release artifact before execution.

Attack Path

  1. The user or agent attempts to use the Skill on a system where the oo CLI is not installed.
  2. The command fails with oo: command not found.
  3. Following the first-time setup instructions, the user or agent runs one of the documented installation pipelines.
  4. The command downloads the current response from the remote installer endpoint.
  5. Bash or PowerShell executes the response immediately, without integrity or authenticity verification.
  6. If the endpoint or delivery chain has been compromised, attacker-controlled commands execute with the privileges of the invoking account.

Impact Assessment

Successful exploitati ...[truncated 873 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash and irm | iex installation pipelines.
  2. Prefer installation through a trusted operating-system package manager with a pinned package version.
  3. If release artifacts must be downloaded directly, pin an immutable version and exact artifact URL rather than using a mutable generic installer endpoint.
  4. Download the artifact to a local file without executing it automatically.
  5. Publish a cryptographic checksum or signature through an independently authenticated channel, and require verification before execution.
  6. Display or document the installer's expected behavior, destination paths, network access, and required permissions.
  7. Require explicit user approval before running the verified installer; the agent should not perform installation automatically after a command failure.
  8. Run installation with ordinary user privileges unless a narrowly defined operation genuinely requires elevation.
  9. For PowerShell, require signature validation and avoid Invoke-Expression; invoke a verified local script file using an appropriately restrictive execution policy.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
93% confidence
Finding

The skill instructs users to execute a remote installation script directly via curl ... | bash, which bypasses integrity verification and gives whatever is served from that URL immediate shell execution. If the install endpoint, transport path, or upstream distribution is compromised, this becomes arbitrary code execution on the host running the skill setup.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Static analysis

No suspicious patterns detected.