ClawHub
Back to skill

Security audit

ClickUp

Security checks for vulnerabilities and agentic risk

Overview

The ClickUp skill is mostly coherent, but its first-time setup tells an agent to run an unverified remote installer directly in a shell, which users should review before installing.

Before installing, review the oo CLI installation path yourself and prefer an official, versioned, verifiable installer or package-manager method. Do not let the agent run the curl|bash or irm|iex setup automatically, especially from an elevated shell. Once installed, confirm exact ClickUp payloads before any write or delete action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:122
Finding

Unverified Remote Installer Scripts Are Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 122–126
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions retrieve mutable scripts from an external OOMOL endpoint and immediately pass their contents to a command interpreter. Neither installation path pins a specific release nor verifies a cryptographic signature or checksum before execution.

The effective installer payload is not included in the audited project and can change after this Skill has been reviewed. Consequently, the safety of the executed code depends entirely on the continued integrity of the remote hosting infrastructure, domain, DNS and TLS path. Although the URLs use HTTPS and an apparently vendor-controlled domain, these properties do not provide artifact-level integrity or make immediate execution necessary.

The instructions only invoke installation after an oo: command not found error, which reduces how often the behavior is triggered. It does not mitigate the risk once the installation branch is reached.

Attack Path

  1. The Agent attempts to use the declared ClickUp integration and receives an oo: command not found error.
  2. Following the first-time setup instructions, it downloads install.sh or install.ps1.
  3. The remote service, hosting account, distribution infrastructure, DNS/TLS path, or installer content has been compromised or maliciously changed.
  4. Because the response is piped directly to bash or iex, the modified payload executes without prior inspection or integrity verification.
  5. The payload performs arbitrary actions using the privileges of the Agent or user running the command.

Impact Assessment

Successful exploitation provides arbitrary command ex ...[truncated 846 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all curl | bash and irm | iex installation patterns.
  2. Direct users to a documented package manager or a version-pinned release artifact from an authenticated official repository.
  3. Download the installer or binary to a local file without executing it automatically.
  4. Pin the expected version and verify a vendor-published cryptographic signature or SHA-256 checksum before execution.
  5. Fail closed when verification is unavailable or does not match; never fall back to executing an unverified response.
  6. Show the artifact source, version, checksum, and intended system changes to the user.
  7. Require explicit user approval before running installation commands, especially when they may alter executable search paths or system directories.
  8. Prefer a minimally privileged, user-scoped installation and explicitly warn against running the installer as root or Administrator.
  9. Keep installation separate from normal Skill execution so a ClickUp request cannot implicitly trigger third-party code installation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via a remote script piped directly into a shell (curl ... | bash), which executes unverified code from the network without integrity checking or review. If the remote host, transport, CDN, or install script is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY ClickUp request" and "Whenever a task involves ClickUp," which is extremely broad and lacks boundaries or exclusion conditions. This can overlap with many ordinary requests that merely mention ClickUp, making activation scope ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.