ClawHub
Back to skill

Security audit

Delighted

Security checks for vulnerabilities and agentic risk

Overview

This Delighted connector is coherent, but it needs review because its setup instructions run unverified remote installer scripts.

Review the setup path before installing. Prefer installing the oo CLI through verified official release instructions, pinned versions, checksums, or signed packages, and confirm exact targets before any Delighted write, delete, or unsubscribe action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Remote Installer Scripts Are Downloaded and Executed Without Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Affected code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe installer content retrieved from cli.oomol.com directly into Bash or PowerShell. The downloaded payload is neither pinned to an immutable version nor authenticated using a published checksum or cryptographic signature before execution.

Although installing the oo CLI may be necessary when it is absent, immediate execution of mutable remote content exceeds the minimum privilege and trust required to provide installation guidance. The effective code is controlled by the remote server at execution time and can change after this Skill has been reviewed. Consequently, auditing SKILL.md does not establish what commands will ultimately run.

This behavior creates a remote code-execution channel if the hosting infrastructure, release process, DNS resolution, TLS trust chain, or installer content is compromised. HTTPS protects transport under normal conditions but does not provide payload immutability or protect against compromise of the legitimate distribution server. No evidence in the audited file establishes that the current remote scripts are malicious; the vulnerability is the unverified execution mechanism itself.

Attack Path

  1. The oo command is unavailable and the Skill follows its documented first-time setup procedure.
  2. An attacker compromises the installer host, its deployment pipeline, or another trusted component capable of serving accepted content from the referenced URL.
  3. The attacker modifies install.sh or install.ps1 to include arbitrary commands.
  4. curl | bash or `irm ...[truncated 1429 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove direct curl | bash and irm | iex execution from the setup instructions.
  2. Prefer a trusted operating-system package manager or an official package repository that verifies signed package metadata.
  3. If standalone installers are required, pin an explicit CLI release version rather than a mutable generic installer URL.
  4. Download the installer to a local file, publish an expected SHA-256 digest through a separately protected release channel, and verify it before execution.
  5. Cryptographically sign release artifacts and require signature verification against a documented, pinned publisher key.
  6. Allow users to inspect the downloaded script before executing it, and fail closed when checksum or signature verification fails.
  7. Run installation with ordinary user privileges and avoid requesting elevation unless a documented installation step strictly requires it.
  8. Keep installation outside routine Skill execution. The Skill should report that the CLI is missing and direct the user to independently verified installation documentation rather than automatically executing remote content.

A safer Unix-style workflow would be:

bash
curl -fL --proto '=https' --tlsv1.2 \
  -o oo-install.sh \
  'https://cli.oomol.com/releases/EXPECTED_VERSION/install.sh'

echo 'EXPECTED_SHA256  oo-install.sh' | sha256sum --check -
less oo-install.sh
bash oo-install.sh

The digest and release version must be replaced with values published through an authenticated release channel. An equivalent signed-artifact verification process should be used on Windows.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software via a remote script piped directly into a shell, which executes unreviewed code fetched at runtime. If the hosting domain, TLS path, or install script is compromised, this becomes immediate arbitrary code execution on the user's machine; the surrounding 'run only on failure' guidance does not materially reduce that risk.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description says to use this skill for ANY Delighted request, which is an overly broad trigger that can cause the agent to invoke this skill for loosely related mentions without sufficient task disambiguation. In context, this skill includes write and destructive operations, so over-invocation increases the chance of unintended access, modification, or deletion of Delighted data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.