ClawHub
Back to skill

Security audit

Cisco Meraki

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Cisco Meraki read-only purpose, but its fallback setup tells users to run unverified remote installer scripts directly in a shell.

Install only if you are comfortable using OOMOL as the intermediary for Cisco Meraki access. Do not run the documented curl|bash or irm|iex installer blindly; prefer an official package, verified download, or manual review of the installer first, and avoid elevated shells unless the vendor clearly requires them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a remotely downloaded script directly into Bash. The script is not pinned to an immutable version, downloaded for inspection, or verified using a cryptographic checksum or signature before execution. Consequently, the effective code can change after the Skill has been audited.

HTTPS provides transport protection but does not ensure that the retrieved script is safe if the hosting account, domain, DNS infrastructure, web server, or upstream release pipeline is compromised. Because the instruction invokes bash, the retrieved payload can execute arbitrary commands with all permissions available to the user running the installation command.

Although installing the oo CLI supports the Skill's declared functionality, immediate execution of mutable network content exceeds the minimum privileges and trust necessary for installation. A verified, version-pinned artifact or trusted package manager would provide the required functionality with lower supply-chain risk.

Attack Path

  1. An attacker compromises the remote installation endpoint, its hosting infrastructure, DNS resolution, or the associated release pipeline.
  2. The attacker replaces or modifies https://cli.oomol.com/install.sh with a malicious shell payload.
  3. A user encounters an oo: command not found error and follows the documented setup instruction.
  4. curl retrieves the attacker-controlled content and streams it directly to Bash without local inspection or integrity verification.
  5. Bash executes the payload with the invoking user's privileges.
  6. The payload can access user-readable files and credentials, modify the user's environmen ...[truncated 647 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash installation pattern.
  2. Direct users to an official, version-pinned release artifact or a trusted package manager.
  3. Download the installer or binary to a local file before execution.
  4. Publish a SHA-256 or stronger checksum through a separately protected channel and require users to verify it.
  5. Prefer signed releases and validate the publisher's signature before installation.
  6. Display or inspect the downloaded script before running it.
  7. Document that installation must use an unprivileged account unless a specific operation demonstrably requires elevation.
  8. Pin documentation to an immutable release URL rather than a mutable install.sh endpoint.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and passes the response directly to Invoke-Expression (iex). This executes the response as PowerShell code without version pinning, local review, checksum validation, or signature verification.

Invoke-Expression gives the retrieved content access to the full PowerShell execution context and the invoking user's privileges. Transport security alone does not protect against a compromised legitimate endpoint or software release pipeline. The retrieved payload can also change after review without requiring any modification to this Skill package.

Installing the CLI is related to the declared functionality, but direct evaluation of network content is not the least-privileged installation method. A signed, versioned package can install the same tool without granting mutable remote content an immediate code-execution channel.

Attack Path

  1. An attacker compromises the PowerShell installer endpoint, hosting account, DNS infrastructure, or upstream deployment pipeline.
  2. The attacker publishes malicious PowerShell content at https://cli.oomol.com/install.ps1.
  3. A Windows user follows the documented installation command after the oo command is unavailable.
  4. irm downloads the malicious content into the PowerShell pipeline.
  5. iex evaluates it immediately without artifact integrity or publisher verification.
  6. The payload executes arbitrary PowerShell operations under the user's security context and may access credentials, alter user configuration, download further payloads, or create persistence in locations writable by that use ...[truncated 508 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the irm | iex installation command.
  2. Distribute a version-pinned package or installer through a trusted Windows package repository or immutable release URL.
  3. Download the package separately rather than evaluating its network response.
  4. Require Authenticode signature validation and reject unsigned or untrusted installers.
  5. Publish and verify a cryptographic checksum through an independently protected channel.
  6. Avoid Invoke-Expression; invoke only a verified local artifact using explicit arguments.
  7. Instruct users to install without administrator privileges unless elevation is demonstrably necessary.
  8. Document the expected publisher identity, version, checksum, and verification procedure.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs use of a remote install command that pipes a downloaded script directly into bash. If the hosting domain, transport path, or script content is compromised, this becomes immediate arbitrary code execution on the user's system, and placing it in a fallback path inside the skill makes an agent more likely to surface or run it during troubleshooting.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and description present the skill as limited to searching and reading data, but the body explicitly allows for actions tagged [write] or [destructive]. This mismatch can mislead an agent or user into invoking the skill under a lower-risk assumption, weakening consent and safety checks around state-changing operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text says to use this skill for ANY Cisco Meraki request and instead of calling the API directly, which is overly broad and can cause automatic routing of unrelated or higher-risk Meraki tasks into this skill without nuanced review. Overbroad activation increases the chance that sensitive, admin-level, or unexpected operations are attempted through a tool the user did not specifically select.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.