ClawHub
Back to skill

Security audit

Conductor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent read-only Conductor connector, but its setup instructions tell users to execute remote installer scripts directly in a shell without verification.

Review the setup section before installing. The connector workflow itself is read-only and reasonably scoped, but avoid running the documented curl | bash or irm | iex installer commands unless you independently trust and verify the OOMOL installer source; prefer an official package manager, pinned release, or downloaded-and-verified installer.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installer Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The first-time setup instructions execute mutable remote installation scripts without pinning a release or verifying the scripts' integrity.

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both commands connect code retrieval directly to a command interpreter. The Unix command pipes the response from cli.oomol.com into Bash, while the PowerShell command passes the downloaded response to Invoke-Expression. Neither procedure lets the user inspect the payload before execution, pins it to an immutable version, or validates a cryptographic signature or checksum.

The download domain is consistent with the declared OOMOL service, and the installation step is relevant when the required CLI is unavailable. However, repository review only establishes the URL being used; it cannot establish the integrity of the script currently or subsequently served from that URL. The effective code can change after the Skill has been audited. Consequently, compromise of the hosting service, publishing pipeline, domain resolution, or trusted delivery infrastructure could turn these instructions into an arbitrary-code execution channel.

This method exceeds the minimum privileges necessary to install the declared CLI safely because it gives current server-controlled content immediate access to a general-purpose shell. No malicious content inside the downloaded scripts was established during this repository-only audit.

Attack Path

  1. The oo command is unavailable, causing the user or agent to consult the first-time setup instructions.
  2. An attacker compromises the installer host or its release pipeline, or otherwise causes malicious content t ...[truncated 1101 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash and irm | iex installation patterns.
  • Prefer a trusted platform package manager or a versioned release artifact from an official repository.
  • Pin the CLI to a specific, immutable version rather than retrieving a mutable generic installer.
  • Publish cryptographic checksums and preferably signed release manifests, then require verification before execution.
  • Download the installer to a local file, verify its signature or checksum, and allow inspection before running it as a separate step.
  • Document the permissions and filesystem changes required by installation, and instruct users to install without administrator privileges unless a specific operation demonstrably requires elevation.
  • If bootstrap scripts must remain available, use commands equivalent to the following workflow: download, verify against an independently obtained digest or signature, inspect, and execute only after verification.
  • Preserve the existing behavior of attempting normal oo commands first; installation should remain an explicit, user-controlled fallback rather than an automatically executed action.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly without prior inspection or integrity verification. If the install endpoint, transport, or hosting account is compromised, this can lead to arbitrary code execution on the user's machine under their privileges.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Conductor request," which is a very broad activation condition and does not define clear boundaries for when the skill should or should not be invoked. It also lacks negative examples or scope constraints beyond mentioning Conductor generally, increasing the risk of unintended invocation overlap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.