ClawHub
Back to skill

Security audit

Elastic Email

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Elastic Email operations, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Install only if you are comfortable using OOMOL's oo CLI for Elastic Email and handling write/delete actions with explicit confirmation. For setup, prefer reviewing official installer documentation, using a trusted package manager or signed release if available, and avoiding direct pipe-to-shell execution unless you have verified the source and accept the local execution risk.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding

Unverified Remote Installer Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 67
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes the response from a remote URL directly into Bash. The downloaded content is not version-pinned, inspected, checksum-verified, or authenticated with a separately distributed cryptographic signature before execution.

Consequently, the code ultimately executed can change after the Skill has been audited. HTTPS protects data in transit under normal conditions, but it does not mitigate compromise of the hosting server, publishing account, DNS or certificate infrastructure, or a malicious future replacement of the installer. This installation method is not necessary to perform the declared Elastic Email operations when the CLI is already installed, and it grants the remote installer substantially broader local privileges than the connector actions themselves require.

Attack Path

  1. An Elastic Email action fails because the oo command is unavailable.
  2. The user or agent follows the documented first-time setup procedure.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without validation or inspection.
  5. If the remote script or its delivery infrastructure has been compromised, attacker-controlled shell commands execute with the privileges of the invoking user.
  6. Those commands can access files and environment variables available to that user, alter the local environment, install additional software, or launch further payloads.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The accessible scope can include user-readable files, environment variables, local credentials, shell configuration ...[truncated 289 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation command.
  • Prefer a trusted operating-system package manager or a version-pinned installer artifact.
  • Download the installer to a local file instead of executing the network response immediately.
  • Publish a SHA-256 digest or cryptographic signature through an independently protected channel and verify it before execution.
  • Pin the installer to a reviewed release rather than a mutable install.sh endpoint.
  • Display the resolved source, version, permissions, and intended changes, then obtain explicit user approval before installation.
  • Run installation with the minimum required privileges and avoid administrator elevation unless a documented component strictly requires it.
  • Keep installation outside automated connector execution; failure to locate the CLI should produce guidance rather than trigger unattended installation.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:71
Finding

Unverified Remote Installer Executed Through PowerShell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 71
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and sends the response directly to Invoke-Expression (iex). Invoke-Expression interprets the downloaded text as PowerShell code immediately. No fixed release, checksum, signature validation, local review, or content allowlist is required.

The effective executable payload is therefore controlled by the content served from the external endpoint at installation time rather than by the audited Skill package. Although the URL uses HTTPS, a compromised server, publisher account, or delivery infrastructure could still return attacker-controlled commands. Installing a CLI is also outside the minimum privileges needed for ordinary Elastic Email connector actions when the CLI is already available.

Attack Path

  1. An attempted connector action fails because oo is not installed on Windows.
  2. The user or agent follows the first-time setup documentation.
  3. PowerShell retrieves the current content of https://cli.oomol.com/install.ps1.
  4. The pipeline passes that content directly to Invoke-Expression.
  5. A modified or compromised response executes as PowerShell code with the invoking process's privileges.
  6. The payload can read accessible data, modify the user's PowerShell environment, download secondary components, or execute other local commands.

Impact Assessment

Successful exploitation permits arbitrary PowerShell execution in the current user's security context. This can expose user files, environment variables, cached credentials accessible to the process, and writable configuration or application data. If PowerShell is running elevated, the potential scope ...[truncated 264 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pipeline and never pass an unverified network response to Invoke-Expression.
  • Prefer a trusted Windows package manager or a signed, version-specific installer.
  • Download the artifact to disk, validate its Authenticode signature and publisher, and verify a separately published cryptographic digest.
  • Pin installation instructions to an immutable reviewed release.
  • Require explicit user approval after presenting the source, version, signature status, requested privileges, and expected system changes.
  • Execute with standard-user privileges wherever possible and clearly document any action that requires elevation.
  • Treat a missing CLI as a recoverable setup error rather than automatically executing installation code.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a network-fetched script without verification, pinning, or integrity checks. If the install endpoint, transport path, DNS, or upstream distribution is compromised, this can lead to arbitrary code execution on the host running the skill.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Elastic Email request" and "Whenever a task involves Elastic Email," which is a very broad activation condition. It does not define narrower trigger boundaries or exclusion cases, so ordinary references to Elastic Email could unintentionally match.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.