ClawHub
Back to skill

Security audit

Currents API

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent read-only Currents API connector, but its first-time setup tells agents to run an unverified remote installer script directly in a shell.

Install only if you are comfortable with OOMOL and Currents API connector use. Avoid letting an agent run the documented remote installer one-liners automatically; prefer installing the oo CLI from a verified release or package manager, and review any installer before execution.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Installer Scripts Executed Directly by Shell Interpreters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions download scripts from cli.oomol.com and pass their contents directly to Bash or PowerShell. The scripts are not pinned to an immutable version, authenticated with a cryptographic signature, or checked against a known checksum before execution. Users and agents also receive no opportunity to inspect the downloaded content before it runs.

HTTPS provides transport protection but does not establish that the mutable script remains identical to the version assessed during this audit. Compromise of the distribution server, publishing account, DNS or network trust path, or installer-generation infrastructure could turn these commands into an arbitrary-code delivery mechanism.

Installing the required CLI is related to the Skill's declared functionality, but executing an unverified network response immediately exceeds the minimum safe privilege necessary. A safer installation process could download a pinned artifact, verify its integrity, and require explicit approval before execution.

Attack Path

  1. The oo CLI is unavailable, causing the user or agent to follow the first-time setup instructions.
  2. An attacker compromises the remote installer, its publishing infrastructure, or another trusted component in its delivery path.
  3. The attacker modifies install.sh or install.ps1 to include malicious commands.
  4. The documented curl | bash or irm | iex command retrieves the modified payload.
  5. Bash or PowerShell executes the response immediately without local inspection or integrity verification.
  6. The payload operat ...[truncated 776 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove direct curl | bash and irm | iex execution from the setup instructions.
  2. Pin installation artifacts to an immutable, reviewed release rather than mutable installer endpoints.
  3. Download the artifact to a local file before execution so its contents can be inspected.
  4. Publish SHA-256 checksums and, preferably, cryptographic signatures through a separately secured channel.
  5. Verify the checksum and release signature before running the installer; abort installation on any mismatch.
  6. Prefer a trusted operating-system package manager or signed package format with built-in integrity and publisher verification.
  7. Require explicit user approval before executing any downloaded installer.
  8. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation, and document any required filesystem or network access.
  9. Consider using commands equivalent to the following controlled flow:
bash
curl -fSLo oo-install.sh "https://cli.oomol.com/releases/<pinned-version>/install.sh"
echo "<expected-sha256>  oo-install.sh" | sha256sum --check -
less oo-install.sh
bash oo-install.sh

The PowerShell installation flow should likewise use a pinned download, validate an Authenticode signature or published checksum, and execute only after successful verification and user approval.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill recommends piping a remotely fetched script directly into a shell, which creates a supply-chain and remote code execution risk if the install endpoint, transport, or hosting environment is compromised. Because this appears in a fallback setup path inside an agent skill, an automated or semi-automated agent could execute it with little scrutiny, increasing the chance of unsafe code execution on the local system.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Currents API request" and "Whenever a task involves Currents API," which is a very broad activation condition without exclusions or boundaries. This can overlap with many contexts, including discussion or planning tasks, and does not specify when the skill should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.