ClawHub
Back to skill

Security audit

Encharge

Security checks for vulnerabilities and agentic risk

Overview

This Encharge skill is mostly coherent, but its first-time setup tells users to execute unverified remote installer scripts, which is a meaningful local security risk.

Review the oo CLI installation path before installing. Prefer official package-manager or version-pinned installers with signature or checksum verification, and do not run the provided remote shell or PowerShell pipeline from an elevated session. Also confirm exact email payloads before allowing the send_email action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:55
Finding

Unverified Remote Shell Script Execution via curl and bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 55
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable shell script from an external server and pipes it directly into bash. The script is executed without version pinning, checksum validation, digital-signature verification, or an opportunity for local inspection.

HTTPS provides transport protection but does not establish that the script is safe if the hosting infrastructure, publishing account, domain, or certificate trust chain is compromised. Because the effective payload can change after the Skill has been reviewed, this behavior crosses the local package trust boundary and constitutes remote payload retrieval and execution.

Installing a CLI may be necessary for the declared Encharge integration, but immediate execution of unverified network content is not the minimum privilege or safest installation method required for that purpose.

Attack Path

  1. An attacker compromises the remote installer, its hosting infrastructure, publishing credentials, or another trusted delivery component.
  2. The oo command is unavailable, causing the documented first-time setup path to be used.
  3. A user or agent runs the supplied curl | bash command.
  4. curl retrieves the attacker-controlled response.
  5. bash executes that response immediately with the privileges and filesystem/network access of the invoking user.
  6. The payload can modify user-accessible files, invoke other programs, access credentials available to that user, or transmit accessible information over the network.

Impact Assessment

Successful exploitation provides arbitrary command execution in the invoking user's security context. The affected scope includes files, en ...[truncated 470 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash pipeline and direct users to official, reviewable installation documentation.
  2. Use a version-pinned release artifact from the official project repository rather than a mutable installer endpoint.
  3. Download the artifact to disk without executing it automatically.
  4. Publish and verify a cryptographic signature from a trusted release key, or at minimum verify a pinned SHA-256 checksum obtained through an independently trusted channel.
  5. Allow the user to inspect the downloaded installer before execution.
  6. Require explicit user approval immediately before running any installer.
  7. Run installation with ordinary user privileges and avoid elevation unless a clearly documented operation strictly requires it.
  8. Prefer a trusted platform package manager with signed packages and reproducible version selection where available.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote PowerShell Script Execution via Invoke-RestMethod and Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Code Snippet:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell installation instruction uses irm (Invoke-RestMethod) to retrieve content from an external URL and pipes the response directly to iex (Invoke-Expression). This causes mutable network-delivered PowerShell code to execute immediately.

The instruction does not pin a release, validate an Authenticode signature, check a cryptographic digest, or save the script for inspection. A later modification or compromise of the remote endpoint can therefore change the commands executed without changing the audited Skill file. The use of Invoke-Expression also eliminates a meaningful review boundary between downloading and execution.

Installing the required CLI supports the declared functionality, but executing an unverified remote script is not necessary to provide that functionality and exceeds a least-risk installation design.

Attack Path

  1. An attacker compromises the PowerShell installer endpoint, its hosting or publishing credentials, or another trusted delivery component.
  2. A Windows user or agent encounters the documented oo: command not found setup condition.
  3. The supplied PowerShell command is executed.
  4. Invoke-RestMethod downloads attacker-controlled PowerShell source.
  5. Invoke-Expression evaluates the response directly in the current PowerShell session.
  6. The payload executes with the invoking user's permissions and can access user-readable data, alter user-writable files, launch processes, or communicate with external systems.

Impact Assessment

Exploitation permits arbitrary PowerShell command execution under the invoking account. The exposed scope includes that account's file ...[truncated 361 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the irm | iex instruction.
  2. Provide a version-pinned, signed Windows release package or installer through an official distribution channel.
  3. Download the package to disk separately from execution.
  4. Verify its Authenticode signature and expected publisher identity before running it.
  5. Where signatures are unavailable, publish and verify a pinned SHA-256 checksum through an independently trusted channel.
  6. Require explicit user confirmation after displaying the selected version, source, signature status, and intended changes.
  7. Execute with standard-user permissions unless elevation is strictly required and separately approved.
  8. Prefer a trusted Windows package manager source that validates package provenance and supports explicit version selection.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This is a genuine supply-chain risk because any compromise of the hosting domain, CDN, TLS termination, or install script contents would result in immediate arbitrary code execution on the local machine without an opportunity for inspection.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Static analysis

No suspicious patterns detected.