ClawHub
Back to skill

Security audit

Cloudflare Docs

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only Cloudflare Docs connector, but its setup instructions tell users to run unverified remote install scripts directly in a shell.

Install only if you are comfortable using OOMOL's CLI and connector for Cloudflare Docs. Do not run the documented pipe-to-shell installer commands unless you independently trust and verify the installer source; prefer a signed package, pinned release, checksum/signature verification, or manual inspection before execution.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:56
Finding

Unverified Remote Shell Script Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 56
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable script from an external URL and pipes it directly into Bash. The script is executed without version pinning, checksum verification, cryptographic signature validation, or an opportunity to inspect the downloaded content.

The HTTPS connection protects data in transit under normal conditions, but it does not establish that the current script is the same artifact that was reviewed. Compromise of the remote server, publishing account, domain, certificate infrastructure, or build pipeline could change the effective payload after the Skill has been audited.

Attack Path

  1. The oo CLI is absent, causing the documented first-time setup condition to apply.
  2. An Agent or user follows the installation instruction.
  3. curl retrieves the current content of https://cli.oomol.com/install.sh.
  4. The pipeline passes that content directly to Bash without integrity validation or review.
  5. Bash executes every command supplied by the remote endpoint with the privileges of the invoking user.
  6. A compromised installer can access user-readable files, modify writable files, invoke other installed programs, make additional network requests, or establish persistence where the user's permissions allow it.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the account running the command. This may expose credentials and user data accessible to that account, alter project or shell configuration files, install additional software, and enable further payload retrieval. If the command is run from an elevated shell, the impact could extend to system-wide compromise; ...[truncated 55 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell.
  • Refer to a specific, immutable CLI release rather than a mutable installation endpoint.
  • Download the installer or binary to a local file without executing it.
  • Verify a publisher-provided cryptographic signature or a checksum obtained through a trusted, independent release channel.
  • Allow the user to inspect the artifact before execution.
  • Require explicit user approval immediately before running the verified installer.
  • Run installation with ordinary user privileges unless elevated privileges are demonstrably necessary.
  • Prefer a trusted package manager or signed release package with provenance and reproducible release metadata.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote PowerShell Script Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and sends the response directly to Invoke-Expression (iex). The downloaded code is therefore evaluated immediately without an immutable version, local inspection, checksum verification, or Authenticode signature validation.

Because the effective program is controlled by the content currently served at the external URL, it can change after review. HTTPS alone does not protect against compromise of the legitimate hosting environment, publisher account, or release pipeline.

Attack Path

  1. The oo CLI is unavailable on a Windows system.
  2. An Agent or user follows the documented PowerShell installation command.
  3. Invoke-RestMethod downloads the current content of https://cli.oomol.com/install.ps1.
  4. The pipeline supplies the response directly to Invoke-Expression.
  5. PowerShell evaluates the remote script with the privileges and environment of the invoking account.
  6. If the installer endpoint or its publishing process is compromised, attacker-controlled commands can read accessible data, alter files and user configuration, launch processes, contact other hosts, or create persistence within the account's permissions.

Impact Assessment

Successful exploitation enables arbitrary PowerShell execution as the invoking user. Potential consequences include disclosure of accessible credentials and documents, modification of PowerShell profiles or other writable configuration, installation of additional payloads, and compromise of the user's account. Execution from an elevated PowerShell session could result in system-wide compromise, althou ...[truncated 54 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex execution pattern.
  • Pin installation instructions to a specific, immutable release.
  • Download the installer to disk before execution.
  • Validate its Authenticode signature and a cryptographic checksum published through a trusted release channel.
  • Reject unsigned, invalidly signed, or checksum-mismatched artifacts.
  • Present the verified file and intended effects to the user and obtain explicit approval before execution.
  • Use a signed MSI, Microsoft Store package, or trusted package-manager distribution when available.
  • Avoid elevated execution unless installation genuinely requires it and the user has approved the exact privileged operation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly from the network without prior verification. If the install endpoint, transport, DNS, or hosting account were compromised, this would lead to immediate arbitrary code execution on the user's machine. In skill context, this is more dangerous because the text presents it as a remediation step users may follow during auth/setup failures.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says to use this skill for "ANY Cloudflare Docs request" and "Whenever a task involves Cloudflare Docs," which is a broad activation condition without clear boundaries or exclusions. It does not provide negative examples or constraints to distinguish when this skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.