ClawHub
Back to skill

Security audit

CoinMarketCap

Security checks for vulnerabilities and agentic risk

Overview

The CoinMarketCap connector is mostly coherent, but its setup instructions include unverified remote installer scripts that can execute mutable code on a user's machine.

Install only if you are comfortable using OOMOL as the broker for CoinMarketCap access. Avoid piping remote installer scripts directly into a shell; prefer official package-manager or verified installer steps, and review what the oo CLI installation and OOMOL login will persist on your machine/account.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  ```

Technical Analysis

The installation instructions download mutable content from external OOMOL endpoints and pipe the responses directly into Bash or PowerShell. The downloaded scripts are executed without first saving them for inspection, pinning a version, or verifying a cryptographic signature or checksum.

HTTPS protects the connection in transit but does not establish that the retrieved script is the same payload reviewed during this audit. Compromise of the distribution endpoint, its infrastructure, or the relevant trust chain could alter the effective executable payload after publication of the Skill.

Installing the required CLI is related to the Skill's functionality, but immediate execution of an unverified remote response exceeds the minimum privileges necessary. A separately downloaded, pinned, and authenticated release would provide the same functionality with substantially lower risk. The repository contains no local copy of the installer through which its behavior could be audited.

Attack Path

  1. The oo CLI is absent, causing the documented first-time setup condition.
  2. A user or agent follows the installation instructions.
  3. An attacker who has compromised the installation endpoint or its delivery infrastructure changes the returned script.
  4. curl or irm downloads the attacker-controlled response.
  5. Bash or PowerShell executes that response immediately without integrity verification.
  6. The payload performs arbitr ...[truncated 725 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both direct execution patterns:

    • curl ... | bash
    • irm ... | iex

  2. Distribute the CLI through a trusted package manager or a versioned release hosted on an authenticated official channel.

  3. Pin the installation instructions to a specific reviewed version rather than a mutable endpoint.

  4. Download the artifact separately and verify a publisher signature or a pinned SHA-256 checksum before executing it.

  5. Abort installation if signature or checksum validation fails.

  6. Require explicit user approval before installing software, and state what files and permissions the installer requires.

  7. Run installation with ordinary user privileges unless elevated access is demonstrably necessary.

  8. Prefer instructions similar to the following workflow:

    bash
    curl -fSLo oo-installer.sh https://trusted.example/releases/vX.Y.Z/install.sh
echo '<PINNED_SHA256>  oo-installer.sh' | sha256sum --check -
less oo-installer.sh
bash oo-installer.sh

    The actual URL, version, and checksum must come from an authenticated, official release and must be updated through a controlled review process.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The instruction curl -fsSL https://cli.oomol.com/install.sh | bash downloads and executes a remote script without verification, which is a classic supply-chain and remote-code-execution risk. If the server, network path, or distribution channel is compromised, the agent could execute arbitrary code on the host under the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill includes instructions to trigger OOMOL login and open account-connection flows, which exceeds the stated purpose of a CoinMarketCap read/search skill. In an agentic setting, this can cause the agent to initiate authentication or connection actions that affect the user's broader OOMOL account context, creating unnecessary account-interaction risk and possible phishing-style redirection to external setup pages.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest description at L03 narrows the skill to CoinMarketCap requests for searching and reading data. However, the documented behavior includes using the oo CLI for account-connected operations and explicitly instructs running oo auth login or directing users to connection and billing URLs when errors occur, which extends beyond simple data-reading behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.