ClawHub
Back to skill

Security audit

Concord

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its Concord read-only purpose, but its first-time setup includes direct execution of remote installer scripts that users should review carefully.

Install only if you are comfortable with OOMOL-mediated access to your Concord account and handle CLI installation yourself from verified official sources. Do not blindly run the curl-to-bash or irm-to-iex installer commands; prefer reviewed, signed, or checksum-verified installation steps.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Shell Script Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The first-time setup instructions pipe a remotely downloaded shell script directly into Bash. The effective code is controlled by the remote server and may change after this skill has been reviewed. No fixed version, cryptographic checksum, digital signature, or local inspection step is required before execution.

TLS protects the connection in transit but does not establish that every future script served by the endpoint is safe. Compromise of the hosting service, its deployment pipeline, DNS infrastructure, signing account, or other delivery components could turn this installation command into an arbitrary-code-execution path.

Installing the CLI may support the skill's declared Concord functionality, but immediate execution of mutable remote content exceeds the minimum privilege needed. A verified, version-pinned package or manually inspected installer would provide the required software with substantially less supply-chain risk.

Attack Path

  1. The oo CLI is absent and an action fails with oo: command not found.
  2. The user or agent follows the documented first-time setup procedure.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is streamed directly to Bash without integrity verification or review.
  5. A malicious or compromised response executes commands with the privileges of the invoking account.
  6. The payload can access data available to that account, alter local files, steal credentials, install additional software, or attempt persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's privileges. The affected ...[truncated 438 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation pattern.
  • Direct users to a version-pinned release artifact from the documented upstream repository.
  • Publish and verify a cryptographic checksum or digital signature before installation.
  • Download the installer to a local file, inspect it, and execute it only after successful verification.
  • Prefer a signed operating-system package or trusted package manager with explicit version constraints.
  • Document the expected files, permissions, and system changes made by the installer.
  • Keep installation an explicit user-controlled step rather than allowing an agent to execute it automatically.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote PowerShell Script Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup procedure downloads a mutable PowerShell script with Invoke-RestMethod (irm) and immediately evaluates the response using Invoke-Expression (iex). This creates a remote code-execution channel whose effective payload is determined at execution time rather than audit time.

The instruction provides no release pinning, Authenticode validation, checksum verification, or opportunity to inspect the downloaded script. HTTPS alone does not mitigate compromise of the authorized hosting infrastructure or publication pipeline. Because Invoke-Expression interprets the response as PowerShell code, any malicious content returned by the endpoint executes with the invoking process's privileges.

Installation is relevant only when the required CLI is missing, but executing an unverified network response is not the least-privileged installation approach.

Attack Path

  1. The oo CLI is unavailable on a Windows host.
  2. The user or agent follows the documented PowerShell setup instruction.
  3. Invoke-RestMethod downloads the current content from https://cli.oomol.com/install.ps1.
  4. The response is passed directly to Invoke-Expression.
  5. If the endpoint or its delivery chain supplies malicious content, PowerShell executes it without integrity validation.
  6. The payload can read accessible files and credentials, modify the user's environment, download additional components, or attempt to establish persistence.

Impact Assessment

Exploitation yields arbitrary PowerShell execution with the rights of the invoking account. This may expose user documents, environment variables, browser or CLI configuration acce ...[truncated 323 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pattern and never evaluate a network response directly.
  • Distribute a version-pinned, Authenticode-signed PowerShell script or signed installer package.
  • Download the artifact to disk and validate both its publisher signature and a separately published checksum before execution.
  • Prefer a trusted Windows package manager or signed MSI/MSIX package with an explicit version.
  • Instruct users to review the verified script and run it as a normal user unless elevated privileges are demonstrably required.
  • Document all expected installation effects and provide uninstall instructions.
  • Require explicit user approval for installation rather than permitting automatic agent execution.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a direct remote code execution path if the install host, transport, or script contents are compromised, and it encourages execution without verification, pinning, or integrity checks. In a skill context, this is more dangerous because the content is operational guidance for an automated agent, increasing the chance the unsafe command is run verbatim.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Static analysis

No suspicious patterns detected.