ClawHub
Back to skill

Security audit

Contentful GraphQL

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Contentful GraphQL access, but its setup instructions include unverified remote installer commands that can execute changing code on the user's machine.

Review this before installing. The connector instructions are otherwise narrow, but do not run the one-line remote installer unless you trust OOMOL's installer delivery path; prefer an official package manager or a downloaded, version-pinned installer with checksum or signature verification.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:55
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–59
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions retrieve mutable scripts from cli.oomol.com and immediately execute them through Bash or PowerShell. Neither command pins a specific installer version nor verifies a cryptographic signature or trusted checksum before execution. The downloaded scripts are not included in the reviewed project, so their effective behavior cannot be determined through this static audit.

Although installing the oo CLI supports the Skill's declared functionality, directly executing an unverified remote response exceeds the minimum privilege and trust necessary for installation. The instructions grant the remote endpoint an unrestricted code-execution channel under the invoking user's account. HTTPS protects the connection in transit under normal conditions, but it does not protect against compromise of the hosting infrastructure, publication pipeline, domain, signing account, or installer itself.

No evidence in the reviewed file proves that the current remote installers are malicious. The vulnerability is the unsafe delivery and execution mechanism, which permits the payload to change after review.

Attack Path

  1. The oo command is unavailable, causing the user or Agent to follow the first-time setup instructions.
  2. An attacker compromises the installer host, its deployment pipeline, the served installer, or another trusted delivery component.
  3. The attacker replaces the expected installer response with arbitrary shell or PowerShell commands.
  4. curl | bash or irm | iex passes that response directly to the local interpreter wi ...[truncated 1112 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both direct pipe-to-interpreter installation commands.
  2. Prefer a trusted platform package manager or a signed, version-pinned release from the CLI's authenticated official repository.
  3. Download the installer or binary to a local file without executing it immediately.
  4. Pin an explicit release version rather than retrieving a mutable latest installer.
  5. Publish and verify a cryptographic signature using a separately distributed, trusted public key. If signature verification is unavailable, verify a release-specific SHA-256 or stronger checksum obtained through an independently authenticated channel.
  6. Abort installation when verification fails; never continue with warnings alone.
  7. Allow the user to inspect the downloaded artifact and require explicit approval before execution.
  8. Run installation with ordinary user privileges unless a documented installation step strictly requires elevation.
  9. Provide manual installation instructions and document the files, network endpoints, and permissions used by the CLI.
  10. If an installer script remains necessary, pin its immutable revision and use a workflow equivalent to:
bash
curl -fL --proto '=https' --tlsv1.2 \
  -o oo-install.sh \
  'https://trusted.example/releases/vX.Y.Z/install.sh'
echo '<PUBLISHED_SHA256>  oo-install.sh' | sha256sum -c -
bash oo-install.sh

The example URL and digest must be replaced with an authenticated official release and its genuine release-specific checksum. A verified digital signature is preferable to a checksum alone.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into bash, which is a classic supply-chain and remote-code-execution risk. If the install endpoint, CDN, TLS termination, or publisher account were ever compromised, arbitrary code would execute immediately on the local machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Static analysis

No suspicious patterns detected.