ClawHub
Back to skill

Security audit

cloudlayer.io

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using cloudlayer.io through OOMOL, but its setup instructions tell the agent to run an unverified remote installer script.

Review this skill before installing. Its cloudlayer.io actions are clearly described, but do not let an agent run the installer commands automatically; install the oo CLI only from a trusted source, preferably with a pinned version and verified checksum or signature.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from an external server and immediately execute them through Bash or PowerShell. Neither command pins a release, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded content before execution.

The installer payload is not included in the audited project. Consequently, its effective behavior cannot be reviewed from this repository and can change after the Skill has passed review. Although the download domain appears related to the declared OOMOL CLI and installation is presented as a fallback when oo is unavailable, immediate pipe-to-shell execution is not the minimum privilege or safest mechanism required to install that CLI.

The network operations used by oo connector run otherwise align with the Skill's declared cloud-service functionality. No covert exfiltration endpoint or embedded credential-harvesting behavior was identified in the audited file.

Attack Path

  1. The oo CLI is absent, causing the first-time setup fallback to apply.
  2. The user or Agent follows the documented installation command.
  3. The command downloads the current script from cli.oomol.com.
  4. Bash or PowerShell executes the response without integrity or authenticity verification beyond ordinary HTTPS transport.
  5. If the hosting server, publishing pipeline, DNS/TLS trust chain, or remote installer is compromised, attacker-controlled commands execute with the privileges of the invoking account.
  6. The malicious payload could then access data available to ...[truncated 748 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation commands.
  2. Prefer an official package manager that validates signed metadata and packages.
  3. Pin installation instructions to a specific, reviewed CLI version rather than a mutable latest installer.
  4. Download the artifact without executing it, then verify a vendor signature or a hard-coded SHA-256 checksum obtained through an independently trusted channel.
  5. Abort installation on any verification failure.
  6. Allow the user to inspect the downloaded artifact before installation.
  7. Run installation without administrative privileges unless a documented component strictly requires elevation.
  8. Publish reproducible release artifacts and signed checksums so the installed binary can be tied to reviewed source.
  9. If scripted installation remains necessary, store a pinned and reviewed installer in a versioned release, verify it before execution, and clearly disclose the files, permissions, and network access it requires.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
94% confidence
Finding

The skill instructs the agent to execute a remote installer via curl ... | bash, which runs code fetched from the network without verification, pinning, or integrity checking. Because the skill is explicitly meant to drive shell execution through Bash, this creates a real supply-chain and remote-code-execution risk if the URL, hosting, or delivery path is compromised.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Static analysis

No suspicious patterns detected.