ClawHub
Back to skill

Security audit

Codegen

Security checks for vulnerabilities and agentic risk

Overview

This Codegen connector is mostly coherent and read-oriented, but its setup instructions include unverified remote installer commands that can execute changing network code.

Install only if you trust OOMOL's CLI distribution path and are comfortable doing the oo CLI setup yourself. Prefer reviewing official install documentation, downloading/verifying installers where possible, and avoid letting an agent run pipe-to-shell setup commands automatically.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Installer Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  ```

Technical Analysis

The installation instructions download mutable content from an external server and immediately execute it through Bash or PowerShell. They do not pin an installer version, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution.

Although cli.oomol.com is consistent with the declared OOMOL integration, domain alignment does not eliminate the risk. Compromise of the installer publication process, hosting infrastructure, CDN, DNS resolution, or TLS endpoint could cause arbitrary attacker-controlled commands to be executed. The effective payload can also change after the Skill has been reviewed.

Installing the CLI may be a legitimate prerequisite, but executing an unverified remote script exceeds the minimum privileges required merely to perform the Skill's advertised read-only Codegen queries.

Attack Path

  1. The oo CLI is unavailable, producing an oo: command not found error.
  2. The user or agent follows the documented first-time setup instructions.
  3. An attacker compromises or gains control over the remote installer delivery path or publication process.
  4. curl or irm retrieves the modified installer.
  5. The shell pipeline passes the response directly to Bash or iex, without integrity verification or inspection.
  6. The attacker's commands execute with the privileges of the user running the installation.

Impact A

...[truncated 835 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace pipe-to-shell installation with a version-pinned package obtained from an authenticated official release channel.
  2. Download the installer or release artifact to a local file rather than executing the network response directly.
  3. Publish and require verification of a cryptographic signature or a pinned SHA-256 checksum before execution.
  4. Display the resolved version, source URL, checksum, and intended installation changes before requesting explicit user approval.
  5. Run installation with ordinary user privileges unless a narrowly scoped operation demonstrably requires elevation.
  6. Prefer an operating-system package manager with signed metadata and reproducible version selection where available.
  7. Keep installation separate from normal Skill execution; the Skill should fail safely and direct the user to independently reviewed setup documentation.
  8. For PowerShell, avoid irm ... | iex; save the script, validate its signature or checksum, permit inspection, and then execute the verified local file.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs users to install the CLI via a remote script piped directly into bash, which executes unverified code from the network immediately. If the hosting domain, transport, DNS, or upstream distribution is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says to use this skill for "ANY Codegen request" and "Whenever a task involves Codegen," which is very broad and does not define clear activation limits or exclusions. In a manifest file, this can cause unintended invocation for casual mentions or loosely related tasks involving Codegen.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.