ClawHub
Back to skill

Security audit

Docmosis

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using Docmosis through OOMOL, but its fallback setup tells users or agents to run unverified remote installer scripts.

Review this skill carefully before installing. Its normal Docmosis connector use is understandable, but avoid running the documented remote installer pipes unless you have independently verified the OOMOL installer source and trust the system changes it will make. Prefer official versioned install instructions with checksum or signature verification, and treat render_document as an action that may generate output and consume service resources rather than a simple read.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Shell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a remotely retrieved, mutable script directly into Bash. The Skill does not pin the installer to a reviewed version, verify a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded content before execution.

Consequently, the effective code executed by this instruction can change after the Skill has been audited. Compromise of the installer host, publishing pipeline, DNS resolution, or TLS trust path could cause arbitrary attacker-controlled shell commands to run with the privileges of the user invoking the Skill. Installing a CLI may be necessary for the declared functionality, but immediate execution of unverified remote content exceeds the minimum privileges and trust required to document that installation.

Attack Path

  1. The oo CLI is absent, and an action fails with oo: command not found.
  2. The user or Agent follows the fallback installation instruction.
  3. curl retrieves the current content of https://cli.oomol.com/install.sh.
  4. The pipe sends that content directly to Bash without integrity or authenticity verification beyond transport security.
  5. If the remote source or delivery path has been compromised, Bash executes attacker-controlled commands under the invoking user's account.
  6. Those commands can access data and credentials available to that account, modify the workspace, install additional software, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user running the installer. The potential scope includes the project workspace, user-readable files, environment credentials, authenticated CLI state, ...[truncated 164 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe downloaded content directly into a shell.
  • Direct users to an official, versioned release artifact or trusted package manager.
  • Pin the CLI to a specific reviewed version rather than retrieving a mutable installer.
  • Download the artifact as a separate step and verify a publisher signature or a SHA-256 checksum obtained through an independently authenticated channel.
  • Allow the user to inspect the installer before execution.
  • Require explicit user approval before installing software or executing installer code.
  • Run installation with ordinary user privileges and request elevation only for a narrowly defined operation when strictly necessary.
  • Document the expected files, permissions, and system changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote PowerShell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup instruction retrieves mutable PowerShell code with Invoke-RestMethod (irm) and immediately evaluates it with Invoke-Expression (iex). There is no version pinning, signature validation, checksum verification, or local review step.

Invoke-Expression treats the response body as executable PowerShell, so control of the remote script or its delivery path becomes direct code execution on the user's Windows host. Although installing the required CLI supports the Skill's declared function, evaluating an unverified network response is not a least-privilege installation mechanism.

Attack Path

  1. The oo CLI is unavailable on a Windows host.
  2. The user or Agent follows the documented first-time setup command.
  3. irm downloads the current response from https://cli.oomol.com/install.ps1.
  4. The response is passed directly to iex without cryptographic validation or inspection.
  5. A compromised installer source or delivery chain supplies malicious PowerShell.
  6. PowerShell executes the payload with the invoking user's privileges, permitting follow-on access, modification, credential collection, or persistence.

Impact Assessment

Exploitation permits arbitrary PowerShell execution under the current security context. An attacker could read user-accessible files and credentials, alter the project or user profile, download additional payloads, manipulate authenticated tooling, and establish persistence. Execution from an elevated PowerShell session could permit system-wide compromise.

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex installation pattern.
  • Provide a version-pinned installer from an official release page or a trusted Windows package repository.
  • Require Authenticode signature validation and fail closed if the publisher or signature is invalid.
  • Publish and verify a cryptographic checksum for downloaded artifacts.
  • Separate download, verification, inspection, and execution into distinct steps.
  • Obtain explicit user approval before running an installer.
  • Avoid administrative execution unless a specific installation operation demonstrably requires it.
  • Document the installer's expected filesystem, registry, environment, and network changes.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to execute a remote install script via curl ... | bash, which is a classic supply-chain risk: any compromise of the hosting domain, TLS interception, or malicious script update can lead to arbitrary code execution on the user's machine. Because this is presented as a remediation step inside the skill, an agent or user may follow it with elevated trust, increasing the chance of unsafe execution.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description frames the skill as limited to 'searching and reading data'. However, the available actions include render_document, which actively generates output documents from templates and input data rather than merely reading existing Docmosis data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The action list presents render_document without a [write] or [destructive] tag, and the safety section states that untagged actions are reads such as get/list/search. Rendering a document is not a read operation; it generates a new result from template data, so the documentation's categorization contradicts the actual action semantics.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.