ClawHub
Back to skill

Security audit

CoinGecko

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent read-only CoinGecko connector, but its setup instructions tell users to run mutable remote installer scripts directly in a shell.

Review the OOMOL CLI installation path before installing. Prefer a signed or package-manager install, or download and inspect/verify the installer before running it. Also expect CoinGecko request payloads and execution metadata to pass through OOMOL rather than going directly to CoinGecko.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:79
Finding
Unverified Remote Installation Scripts Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 79-83 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download mutable scripts from `cli.oomol.com` and immediately execute them with Bash or PowerShell. Neither installation path pins a script version, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded content before execution. Although installing the required CLI is relevant to the Skill, piping network content directly into an interpreter exceeds the minimum safe privileges necessary for installation. The effective code can change after the Skill has been reviewed. Consequently, the security of the installation process depends entirely on the continuing integrity of the remote host, its deployment pipeline, DNS resolution, TLS termination, and the retrieved scripts. The audit found no evidence that the current remote scripts are malicious. The vulnerability is that any future or temporary compromise of the delivery channel would immediately become arbitrary local code execution. ### Attack Path 1. A user attempts to use the Skill without the `oo` CLI installed. 2. The command fails with `oo: command not found`. 3. The user or agent follows the documented first-time setup procedure. 4. Bash or PowerShell retrieves the current installation script from `cli.oomol.com`. 5. The shell executes the response without integrity verification or review. 6. If the remote service or delivery chain has been compromised, attacker-controlled commands execute with the privileges of the user running the installation. ### Impact Assessment A malicious installation response could execute arbitrary commands under the invo ...[truncated 728 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation instructions. 2. Distribute the CLI through a trusted, platform-native package manager and pin an explicit version. 3. If standalone scripts remain necessary: - Publish immutable, versioned script URLs. - Download the script to a local file before execution. - Publish and verify a SHA-256 or stronger digest through an independent trusted channel. - Cryptographically sign releases and verify the signature against a pinned publisher key. - Display the script or installation plan for review. - Require explicit user approval before execution. 4. Run installation with ordinary user privileges unless a documented operation strictly requires elevation. 5. Document the files, executables, network destinations, and configuration changes made by the installer. 6. Prefer commands similar to: ```bash curl -fSLo oo-install.sh "https://example.invalid/releases/v1.0.0/install.sh" echo "<PINNED_SHA256> oo-install.sh" | sha256sum --check bash oo-install.sh ``` The digest and URL must correspond to a real, immutable release and must not be copied from the same mutable response being verified. ]]>

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:3
Finding
Mandatory Third-Party Routing of CoinGecko Requests<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 3-30 **Vulnerability Type**: Skill instruction hijacking and unnecessary third-party data transmission **Risk Level**: Medium ### Vulnerable Instructions ```yaml description: "CoinGecko (coingecko.com). Use this skill for ANY CoinGecko request — searching and reading data. Whenever a task involves CoinGecko, use this skill instead of calling the API directly." ``` ```markdown Operate **CoinGecko** through your OOMOL-connected account. This skill calls the `coingecko` connector with the [oo CLI](https://github.com/oomol-lab/oo-cli); OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```bash oo connector run "coingecko" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill instructs the agent to use the OOMOL connector for every CoinGecko request instead of allowing direct access to CoinGecko. This alters the agent's routing behavior beyond the narrower requirement of performing a specific connector-backed operation. Executing `oo connector run` transmits the supplied JSON payload through the OOMOL-connected service. Depending on the requested action, that payload can include search terms, token contract addresses, network identifiers, asset selections, date ranges, or other user-provided query data. The response also includes an OOMOL execution identifier. The intermediary architecture and server-side credential injection are disclosed in the document. No hardcoded secret, local credential-file access, raw-token exfiltration, or covert transmission mechanism was found. Nevertheless, mandatory third-party routing expands the trust boundary and may disclose request contents and associated metadata where direct public CoinGecko access would have required fewer parties. ### Attack Path 1. A user submits a request involving CoinGecko. 2. The Skill's global instruction causes the agent to select this Skill rather than direct CoinGecko ...[truncated 1168 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the global instruction to use the Skill for “ANY CoinGecko request” with narrowly scoped activation criteria. 2. Invoke the OOMOL connector only when the user explicitly requests OOMOL-backed access or functionality that requires the connected account. 3. Permit direct CoinGecko access for public, read-only data when no connector-specific capability is needed. 4. Clearly disclose: - Which payload fields are transmitted. - Which service receives them. - What account and execution metadata is retained. - Applicable retention and privacy policies. 5. Obtain explicit user confirmation before transmitting sensitive or user-specific payload content. 6. Minimize submitted JSON to fields required by the live connector schema. 7. Avoid placing secrets, unrelated personal data, wallet credentials, private keys, or authentication tokens in `--data`. 8. Provide a documented local or direct-API alternative where feasible. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.