ClawHub
Back to skill

Security audit

Faraday

Security checks for vulnerabilities and agentic risk

Overview

This Faraday skill is mostly coherent, but it directs users to install its required CLI by executing unverified remote installer scripts.

Review the installer path before using this skill. Prefer installing the oo CLI from a verified, version-pinned source with published checksums or signatures, and only use the Faraday actions after confirming they are read-only or after explicitly approving any state-changing operation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:66
Finding

Unverified Remote Installer Scripts Executed Directly by a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66–70
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions pipe content retrieved from mutable remote URLs directly into local command interpreters. Neither command pins a particular installer version, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded content before execution.

Although the scripts are hosted on an OOMOL domain consistent with the declared CLI provider and are only presented as first-time setup instructions, executing network-delivered code is not the minimum privilege or safest mechanism required to install the CLI. The effective installer payload can change after the Skill has been reviewed.

On macOS and Linux, curl passes the server response directly to bash. On Windows, Invoke-RestMethod (irm) supplies the response to Invoke-Expression (iex). Consequently, any commands returned by the remote endpoint are immediately interpreted with the privileges of the user running the installation command.

Attack Path

  1. A user attempts to invoke the Skill without the oo CLI installed.
  2. The documented fallback directs the user to execute one of the remote installation commands.
  3. An attacker compromises the installer hosting infrastructure, authorized publishing process, domain, or another trusted delivery component.
  4. The affected endpoint serves a modified shell or PowerShell script.
  5. bash or Invoke-Expression executes the modified response immediately without integrity validation.
  6. The payload performs arbitrary actions available to the invoking user, potentially including credentia ...[truncated 853 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash and irm | iex installation patterns.
  2. Direct users to a version-pinned release artifact hosted on the official release repository or to a trusted operating-system package manager.
  3. Publish SHA-256 checksums and cryptographic signatures through an independently protected channel.
  4. Require users to download the installer to a local file, verify its checksum and signature, and inspect it before execution.
  5. Pin the documented download to a specific immutable CLI version rather than a mutable install.sh or install.ps1 endpoint.
  6. Execute installation with ordinary user privileges wherever possible and clearly warn users not to elevate privileges unless a documented installation step strictly requires it.
  7. If a bootstrap installer remains necessary, make it a minimal, auditable script that retrieves only signed artifacts and fails closed when signature or checksum verification fails.
  8. Document the destination paths, files created, permissions requested, and network endpoints contacted by the installer.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the operator to install software via 'curl ... | bash', which executes a remotely fetched script directly without prior verification. If the host, network path, or distribution endpoint is compromised, this can lead to arbitrary code execution on the local system.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest and description claim the skill is for 'searching and reading data' and to use it for 'ANY Faraday request', but the body explicitly discusses possible [write] and [destructive] actions. That mismatch can mislead a calling agent or user into invoking a skill believed to be read-only when it may perform state-changing operations, increasing the risk of unauthorized or unintended modifications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger text says to use this skill for 'ANY Faraday request', which is overly broad and can cause an agent to route all Faraday-related tasks here without narrowing by operation type or risk. In the context of ambiguous capabilities, this broad invocation increases the chance of accidental use for sensitive or state-changing actions without sufficient scrutiny.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.