ClawHub
Back to skill

Security audit

Chuhaijiang

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent read-only Chuhaijiang connector, but its fallback setup tells agents or users to execute unverified remote installer scripts.

Review the setup path before installing. Prefer installing the oo CLI from a trusted, versioned release or package manager with signature or checksum verification, and do not run the curl-to-bash or irm-to-iex commands unless you accept that the remote installer can execute code on your machine.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a mutable response from an external URL directly into Bash. The remote script is executed without a pinned version, cryptographic checksum, digital-signature verification, local inspection, or separate user confirmation.

HTTPS protects the connection in transit but does not establish that the downloaded script is safe. Compromise of the hosting service, publisher account, DNS or certificate infrastructure, or deployment pipeline could cause arbitrary attacker-controlled shell commands to be returned. The effective payload can also change after the Skill has been reviewed.

Installing the required CLI may support the declared functionality, but direct remote-to-shell execution is not necessary. It gives the remote endpoint code-execution privileges beyond those required for the Skill's read-only Chuhaijiang operations.

Attack Path

  1. An oo command fails because the CLI is unavailable.
  2. The agent follows the documented first-time setup procedure.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without verification or inspection.
  5. If the remote source or delivery chain has been compromised, attacker-controlled commands execute with the permissions of the user running the agent.

Impact Assessment

A malicious installer could read or modify any files accessible to the current user, steal environment variables or locally available credentials, download additional payloads, alter command-line tools, or establish persistence. If the agent or shell is running with elevated privileges, the payload could affect the broader operating system. The repository ...[truncated 155 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell.
  • Distribute a version-pinned CLI package or installer artifact through a trusted package manager with publisher-signature verification.
  • If a standalone installer is required, download it to a local file first and verify a publisher-provided cryptographic signature or a checksum obtained through an independently trusted channel.
  • Pin the expected CLI version, artifact URL, signer identity, and digest in the setup documentation.
  • Allow the user to inspect the downloaded file and require explicit approval before executing it.
  • Run installation with ordinary user privileges unless a documented operation strictly requires elevation.
  • Prefer instructions similar to: download artifact, verify signature or SHA-256 digest, inspect, and then execute the verified local file.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:68
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows installation instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and passes the response directly to Invoke-Expression (iex). This causes downloaded content to execute immediately without version pinning, checksum validation, signature verification, inspection, or a separate approval boundary.

The use of HTTPS does not mitigate compromise of the publisher, hosting environment, release pipeline, DNS or certificate infrastructure. Because the hosted response may change independently of this Skill, reviewed Skill content does not determine the code ultimately executed.

The CLI may legitimately need installation, but evaluating an unverified network response is not the minimum privilege necessary to provide Chuhaijiang search and retrieval functionality.

Attack Path

  1. An oo command fails on Windows because the CLI is not installed.
  2. The agent follows the first-time setup documentation.
  3. PowerShell retrieves the current content from https://cli.oomol.com/install.ps1.
  4. The pipeline sends that content directly to Invoke-Expression.
  5. A compromised source or delivery chain can therefore execute arbitrary PowerShell commands under the current user's security context.

Impact Assessment

Attacker-controlled PowerShell could access files and credentials available to the current user, modify the user's profile or tools, retrieve further payloads, or establish persistence. Execution from an elevated PowerShell session could enable system-wide modification. The audited file contains no evidence that the currently hosted installer is malicious; the vulnerability is the absence of an integrity and appro ...[truncated 53 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex installation pattern.
  • Provide a version-pinned, Authenticode-signed PowerShell script or signed installer from a controlled release channel.
  • Download the artifact without executing it, validate its Authenticode signature and a published cryptographic digest, and only then run the verified local copy.
  • Document the expected signer, exact version, artifact name, and checksum.
  • Require explicit user approval after verification and before execution.
  • Avoid administrator privileges unless installation genuinely requires them, and clearly document any requested elevation and its purpose.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via a remote script piped directly into bash, which executes code fetched at runtime without integrity verification, pinning, or review. If the install endpoint, transport, or upstream distribution is compromised, this can lead to arbitrary code execution on the host running the skill setup.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Chuhaijiang request" and "Whenever a task involves Chuhaijiang," which is extremely broad and lacks boundaries or exclusion cases. This can overlap with many ordinary references to Chuhaijiang and does not specify what kinds of tasks should or should not invoke the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.