ClawHub
Back to skill

Security audit

DiscoLike

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent DiscoLike connector, but its fallback setup tells agents to run remote installer scripts directly without verification or explicit user approval.

Review this skill before installing. Routine DiscoLike read actions are coherent, but do not let an agent run the first-time installer commands automatically. Install the oo CLI only through a trusted, verifiable method, preferably with a pinned release and signature or checksum verification, then connect DiscoLike intentionally in OOMOL.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction streams a remote script directly into Bash. The remote payload is not version-pinned, downloaded for inspection, or verified using a cryptographic signature or checksum. Consequently, the code executed on a user's system can differ from the content that existed when the Skill was reviewed.

The hostname is consistent with the declared OOMOL service, but this does not guarantee the integrity of every future response. Compromise of the hosting infrastructure, publication process, DNS or TLS trust chain could turn the documented installation command into an arbitrary-code execution channel.

Installing the CLI is not required during ordinary Skill operation because the document assumes that it is already installed. This command is presented only as a fallback after an oo: command not found error. Automatic execution would therefore exceed the minimum behavior needed to perform the Skill's normal read-only DiscoLike actions.

Attack Path

  1. An agent attempts to use the Skill on a system where the oo command is unavailable.
  2. The failure triggers the documented first-time setup procedure.
  3. The agent or user executes the supplied curl | bash command.
  4. curl obtains the current, mutable response from cli.oomol.com.
  5. Bash immediately interprets that response without integrity verification or prior inspection.
  6. If the remote installer or its delivery path has been compromised, attacker-controlled commands execute with the privileges of the invoking account.

Impact Assessment

A malicious installer could execute arbitrary commands with the invoking user's privileges. Depending on those privileges and the payload, this could ...[truncated 305 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation instruction.
  • Prefer an operating-system package manager or another reviewed distribution channel.
  • Pin the installer to a specific immutable release rather than a mutable URL.
  • Download the artifact to disk without executing it, then verify a vendor-published cryptographic signature or SHA-256 digest.
  • Allow the user to inspect the downloaded script before execution.
  • Require explicit user approval before installing software or executing an installer.
  • Run installation with ordinary user privileges unless a specific, documented operation requires elevation.
  • Treat a missing CLI as a setup error rather than automatically executing remote content.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup instruction retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and passes its response directly to Invoke-Expression (iex). Invoke-Expression treats the downloaded text as executable PowerShell code. There is no version pinning, signature validation, checksum verification, local review, or separation between download and execution.

This creates a post-review payload substitution risk: the effective code is controlled by whatever the remote endpoint returns at execution time. Although the endpoint belongs to the service named by the Skill, trust in the hostname does not eliminate risks arising from compromised hosting, release credentials, DNS resolution, or TLS trust.

The command is only a fallback for a missing CLI and is not required for routine connector operations on systems where the declared prerequisite is already present.

Attack Path

  1. An agent attempts to run the Skill on a Windows host without the oo CLI.
  2. The resulting command-not-found error leads to the first-time setup section.
  3. The supplied PowerShell pipeline is executed.
  4. irm retrieves the current content of install.ps1.
  5. iex immediately evaluates the returned text in the active PowerShell process.
  6. If an attacker controls the response or has compromised its delivery chain, arbitrary PowerShell commands execute under the invoking user's security context.

Impact Assessment

Successful exploitation permits arbitrary code execution with the invoking Windows account's privileges. Potential consequences include reading accessible files and credentials, modifying user configuration, installing additional payloads, establish ...[truncated 278 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pipeline.
  • Distribute the CLI through a trusted, reviewed Windows package channel or a version-pinned release artifact.
  • Download the installer without evaluating it and verify its Authenticode signature or a vendor-published cryptographic digest.
  • Permit inspection of the downloaded script before execution.
  • Require explicit user consent before installation.
  • Avoid running the installer from an elevated PowerShell session unless elevation is demonstrably necessary and clearly explained.
  • Ensure that release signing keys and installer publication infrastructure are protected and independently auditable.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software by piping a remote script directly into a shell, which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, publisher account, or upstream distribution is compromised, arbitrary code will run immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest says to use this skill for "ANY DiscoLike request" and "Whenever a task involves DiscoLike," which is an extremely broad activation condition. It does not define narrower trigger phrases, boundaries, or exclusion cases, so ordinary mentions of DiscoLike could invoke the skill unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.