ClawHub
Back to skill

Security audit

Cincopa

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Cincopa read-only connector skill, with a disclosed but higher-risk setup command for installing OOMOL's CLI.

Install only if you are comfortable using OOMOL as an intermediary for Cincopa read access. Before running the oo CLI installer, review OOMOL's official installation guidance and avoid blindly executing remote shell installer commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
97% confidence
Finding
The skill instructs the agent to install software using a remote script piped directly into a shell (`curl ... | bash`), which executes unverified code from the network with the user's privileges. If the install endpoint, transport, hosting, or distribution pipeline is compromised, this becomes an immediate arbitrary code execution path; because it appears in a troubleshooting/setup section, the skill context makes it more dangerous by normalizing unsafe execution as a recommended recovery step.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.