ClawHub
Back to skill

Security audit

Docker Hub

Security checks for vulnerabilities and agentic risk

Overview

This Docker Hub skill is mostly purpose-aligned, but its setup instructions and token-listing action deserve careful review before installation.

Review this skill before installing. Use it only for Docker Hub accounts where the OOMOL connector should have the relevant organization permissions, be cautious with token-listing requests, confirm all write or destructive operations, and avoid running the documented curl-to-bash or irm-to-iex installer commands unless you independently trust and verify the installer source.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:68
Finding

Unverified Unix Installation Script Downloaded and Executed by a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a remotely retrieved script directly into Bash. The executed payload is not included in the audited project, pinned to a specific immutable version, or verified using a cryptographic checksum or signature. Consequently, the effective code can change after the Skill has been reviewed.

HTTPS protects the connection in transit but does not establish payload immutability or protect against compromise of the hosting account, origin server, distribution infrastructure, or signing process. The -f, -s, and -S options also reduce visibility into retrieval behavior before execution.

This behavior exceeds the minimum privileges required for ordinary Skill operation. The Skill only needs to invoke an already-installed oo CLI. Installing software is relevant solely as an exceptional setup step after a missing-command error and should not involve unreviewed code execution.

Attack Path

  1. The oo command is unavailable, or an attacker causes it to appear unavailable.
  2. An agent or user follows the documented first-time setup instruction.
  3. curl retrieves the current contents of https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without local inspection or integrity validation.
  5. If the remote origin, hosting infrastructure, or installation script is compromised, attacker-controlled shell commands execute with the privileges of the user running the command.
  6. The payload can access resources available to that account and may download additional components or modify the local environment.

Impact Assessment

Successful exploitation provides arbitrary command execution under the ...[truncated 631 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation pattern.
  • Prefer a trusted platform package manager and pin the CLI to a reviewed version.
  • If direct installation is unavoidable, download a versioned artifact to disk without executing it automatically.
  • Publish and verify a cryptographic checksum and, preferably, a signature using a separately distributed trusted public key.
  • Display the source, destination, version, and expected system changes before requesting explicit user approval.
  • Execute the verified installer only after inspection and approval, using the least-privileged account possible.
  • Keep installation outside normal Skill execution; ordinary connector operations should only invoke an existing oo binary.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:72
Finding

Unverified PowerShell Installation Script Downloaded and Executed In Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 72
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This command retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and immediately evaluates it with Invoke-Expression (iex). The payload is executed without being saved for review and without version pinning, checksum validation, or signature verification.

The remote script is not part of the audited repository, so its actual behavior cannot be established from the Skill package. Any later alteration at the remote source becomes executable code when a user or agent follows this instruction. Transport encryption alone does not address a compromised origin or unauthorized modification of the hosted installer.

Installation is not required for the Skill's routine Docker Hub connector operations when the declared prerequisite is satisfied. This setup instruction therefore introduces a broader code-execution capability than the minimum needed to invoke the connector.

Attack Path

  1. The Windows environment reports that the oo command is unavailable.
  2. The documented fallback command is run in PowerShell.
  3. Invoke-RestMethod retrieves the current remote install.ps1 content.
  4. The pipeline sends that content directly to Invoke-Expression.
  5. A compromised or maliciously changed response executes as PowerShell code under the current user's security context.
  6. The executed payload can access local resources available to that user and invoke additional operating-system or network functionality.

Impact Assessment

Exploitation permits arbitrary PowerShell execution with the invoking user's privileges. This may expose readable files, environment variables, PowerShell profiles, application configuration, aut ...[truncated 480 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex instruction.
  • Distribute the CLI through a trusted Windows package manager with an explicitly pinned version.
  • Alternatively, download a versioned installer to a local file, verify its Authenticode signature and published cryptographic checksum, and inspect it before execution.
  • Require explicit user approval after presenting the verified publisher, version, destination, and requested privilege level.
  • Do not request elevation unless a documented installation step strictly requires it.
  • Separate installation from routine Skill execution so the Skill only invokes a preinstalled, trusted CLI.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill exposes an action to list organization access tokens, which is credential-sensitive information and can materially aid account compromise, privilege escalation, or lateral movement if invoked for an unintended or unauthorized purpose. In this skill context, the danger is elevated because credentials are injected server-side, making it easy to retrieve sensitive token metadata without the user handling raw auth directly.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
- `get_repository` — Get detailed metadata for a Docker Hub repository within a namespace.
- `get_tag` — Get metadata and image variants for a specific Docker Hub repository tag.
- `get_team` — Get a Docker Hub team within an organization.
- `list_org_access_tokens` — List Docker Hub organization access tokens for an organization.
- `list_org_members` — List Docker Hub organization members with optional filtering and pagination.
- `list_repositories` — List Docker Hub repositories in a namespace with optional name filtering and ordering.
- `list_team_members` — List members of a Docker Hub team within an organization.

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The instruction curl -fsSL https://cli.oomol.com/install.sh | bash executes a remote script directly from the network without integrity verification, which creates a supply-chain and remote code execution risk if the host, transport, or script distribution is compromised. This is especially dangerous in a skill because it normalizes unsafe installation behavior as a remediation step during operation.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description uses very broad activation language: 'Use this skill for ANY Docker Hub request' and 'Whenever a task involves Docker Hub, use this skill'. This lacks limiting conditions or negative examples, so ordinary discussion or loosely related tasks about Docker Hub could be interpreted as triggers for invoking the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.