ClawHub
Back to skill

Security audit

EchoTik

Security checks for vulnerabilities and agentic risk

Overview

The EchoTik skill is mostly a coherent read-only connector, but its setup instructions tell users to execute unverified remote installer scripts.

Review the setup path before installing. Prefer an official signed or checksum-verified oo CLI installer instead of running curl | bash or irm | iex, and only authenticate/connect the EchoTik account when you intentionally want this skill to query EchoTik through OOMOL.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:70
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 70
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and pipes it directly into bash. The downloaded content is neither pinned to a specific version nor authenticated through a published checksum or cryptographic signature. It is also not saved for inspection before execution.

Installing the oo CLI supports the Skill's declared EchoTik functionality, but immediate execution of arbitrary remote content is not the minimum privilege or safest mechanism necessary to perform that installation. The effective code can change after the Skill has been reviewed. Compromise of the remote hosting environment, domain, DNS resolution, TLS termination infrastructure, or release process could therefore turn this instruction into an arbitrary-code execution channel.

Attack Path

  1. The oo command is unavailable, causing the documented first-time setup condition to occur.
  2. An agent or user follows the installation instruction in SKILL.md.
  3. An attacker compromises or maliciously changes the script served from https://cli.oomol.com/install.sh, or compromises infrastructure involved in delivering it.
  4. curl downloads the attacker-controlled content without version or integrity validation.
  5. The shell executes the content immediately as the account that invoked the command.
  6. The payload can access resources available to that account and may download or install additional components.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the invoking user. The payload could read or modify user-accessible files, access credentials or session material available to that ...[truncated 452 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the pipe-to-shell instruction with a version-pinned package or release artifact from a documented distribution channel.
  • Download the installer to a local file rather than executing the network response immediately.
  • Publish a SHA-256 checksum and, preferably, a cryptographic signature through an independently secured channel.
  • Verify the checksum and signature before execution and abort installation if verification fails.
  • Display or permit inspection of the downloaded script before it is run.
  • Execute the installer without elevated privileges unless a narrowly defined installation step genuinely requires them.
  • Document the files, directories, and network destinations used by the installer.
  • Prefer a platform package manager with signed repository metadata and reproducible, versioned releases.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:74
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 74
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and passes the response directly to Invoke-Expression (iex). Invoke-Expression treats the downloaded text as executable PowerShell code. No fixed release version, Authenticode validation, checksum verification, or opportunity for review is included.

Although installation of the oo CLI is relevant to the Skill's functionality, executing an unverified network response is broader and riskier than necessary. The remote endpoint controls the effective payload after publication and review of the Skill.

Attack Path

  1. The oo command is unavailable on a Windows system.
  2. An agent or user follows the documented PowerShell installation instruction.
  3. An attacker compromises or changes install.ps1, its hosting environment, or supporting delivery infrastructure.
  4. Invoke-RestMethod retrieves the attacker-controlled response.
  5. The pipeline passes that response directly to Invoke-Expression.
  6. PowerShell executes the payload under the security context of the invoking user.

Impact Assessment

Successful exploitation permits arbitrary PowerShell execution with the invoking user's privileges. An attacker could access user-readable data, modify user files and PowerShell profiles, retrieve credentials available to the process, install additional payloads, or create persistence within accessible locations. Running the instruction from an elevated PowerShell session could result in system-wide modification or compromise.

The reviewed documentation does not direct users to elevate PowerShell, and no actual malicious PowerShell body is inc ...[truncated 92 chars]

Remediation
View remediation

Remediation Suggestions

  • Distribute a version-pinned and Authenticode-signed PowerShell script, MSI, or package.
  • Download the artifact to disk before execution and verify both its expected publisher and digital signature.
  • Publish and validate a SHA-256 checksum through an independently secured channel.
  • Avoid Invoke-Expression for network-delivered content.
  • Use a trusted Windows package manager or signed installer with explicit version selection where possible.
  • Run installation with standard-user privileges unless a documented operation specifically requires elevation.
  • Document expected installer behavior, filesystem changes, and network destinations so users can review the requested scope.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software by piping a remote script directly into a shell (curl ... | bash), which is a classic supply-chain and arbitrary code execution risk. If the install endpoint, transport, hosting account, or upstream distribution is compromised, the agent or user could execute attacker-controlled code with local privileges.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text says to use this skill for ANY EchoTik request and instead of calling the API directly, which is broader than necessary and can cause the agent to route all EchoTik-related tasks through this skill without evaluating least-privilege alternatives. That increases attack surface and can force execution paths that include shell access and setup instructions even for simple informational requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.