ClawHub
Back to skill

Security audit

Confluent

Security checks for vulnerabilities and agentic risk

Overview

This Confluent skill is mostly coherent, but its setup instructions tell users to run an unverified remote installer directly in a shell.

Review the OOMOL CLI installer before running it, prefer a versioned or package-manager install with checksum/signature verification, and only approve Confluent write or delete actions after checking the exact target and payload.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote Installer Scripts Are Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–67
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe remotely retrieved content directly into command interpreters. The Unix command sends the response from https://cli.oomol.com/install.sh to Bash, while the Windows command uses Invoke-RestMethod and Invoke-Expression to execute install.ps1.

Neither command pins an installer version, verifies a cryptographic signature or checksum, or gives the user an opportunity to inspect the downloaded payload before execution. The effective code can therefore change after the Skill has been reviewed. Although the hostname appears associated with the declared OOMOL service, the audited project contains no installer source or integrity metadata with which to verify the remote payload.

Installing the CLI may support the Skill's declared functionality, but immediate execution of mutable, unrestricted remote code exceeds the minimum trust necessary. A separately downloaded, version-pinned, and cryptographically verified installer would achieve the installation objective with materially lower risk.

Attack Path

  1. A user or agent attempts to use the Skill on a system where the oo command is unavailable.
  2. The command fails with oo: command not found.
  3. The agent follows the documented first-time setup instructions.
  4. The system retrieves the current script from cli.oomol.com.
  5. Bash or PowerShell executes the response immediately without integrity verification.
  6. If the hosting service, publishing pipeline, domain resolution, TLS trust chain, or remote script is compromised, attacker-controlled commands execute under the invoki ...[truncated 1009 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both pipe-to-shell installation patterns.
  2. Direct users to a trusted package manager or a versioned release page where practical.
  3. Pin installation artifacts to a specific version rather than retrieving a mutable generic installer.
  4. Download the installer to a local file without executing it automatically.
  5. Publish a SHA-256 or stronger digest through a separately protected channel and verify it before execution.
  6. Prefer cryptographic signature verification using a pinned, authenticated release-signing key.
  7. Allow the user to inspect and explicitly approve the downloaded script before running it.
  8. Execute installation with ordinary user privileges unless a documented operation strictly requires elevation.
  9. For automated installation, fail closed if the version, signature, checksum, expected content type, or download origin cannot be verified.
  10. Document the files, executables, and configuration changes made by the installer so users can assess its privilege and persistence implications.

A safer workflow is: download a version-pinned artifact, verify its signature and checksum, inspect or display the artifact, request explicit approval, and then execute it with the minimum required privileges.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell, which creates a supply-chain and arbitrary code execution risk if the URL, hosting, or delivery path is compromised. In this skill context, that danger is increased because the command is presented as a remediation step during operational use, making it more likely to be run without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The phrase 'Use this skill for ANY Confluent request' is extremely broad and could overlap with many routine mentions of Confluent, without clarifying boundaries or exclusions. The file does not provide negative examples or narrower trigger constraints to help distinguish when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.