ClawHub
Back to skill

Security audit

Feathery

Security checks for vulnerabilities and agentic risk

Overview

This Feathery connector skill is mostly coherent, but its first-time setup recommends executing remote installer scripts directly in a shell without verification.

Review this skill before installing if the oo CLI is not already present. Prefer installing oo from a verified official package or separately downloading and inspecting/verifying the installer instead of piping it directly into a shell. For normal Feathery use, confirm any write or delete payload before allowing the connector action to run.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–71
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from an external server and execute them immediately through Bash or PowerShell. Neither command pins a specific installer version, saves the script for review, nor verifies a cryptographic signature or checksum before execution.

Although the download hostname is consistent with the declared OOMOL service, the effective code is controlled remotely and can change after this Skill has been reviewed. Compromise of the hosting infrastructure, installer publishing process, DNS resolution, or trusted TLS chain could therefore turn the documented installation process into arbitrary local code execution.

This behavior is not required for routine Feathery operations when the CLI is already installed. Even during first-time setup, immediate pipe-to-shell execution exceeds the minimum safe installation behavior because verified packages or separately downloaded and authenticated artifacts could be used instead.

The Skill otherwise states that Feathery payloads are sent through OOMOL's connector and that credentials are injected server-side. That network behavior is declared and necessary for the connector model; the reviewed file contains no evidence of covert transmission to an unrelated endpoint.

Attack Path

  1. The oo CLI is unavailable, causing an attempted connector operation to fail.
  2. The user or agent follows the first-time setup instructions in SKILL.md.
  3. curl or irm retrieves the current installer script from the external OOMOL endpoint.
  4. The response body is passed directly to Bash or `Invoke-Expres ...[truncated 1026 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove both direct pipe-to-shell installation commands.
  • Direct users to a version-pinned release obtained from an official release page or trusted package manager.
  • Download the installer to disk as a separate step so it can be inspected before execution.
  • Publish a SHA-256 digest through an independently protected channel and require verification before running the artifact.
  • Prefer cryptographic signature verification with a pinned vendor signing key over checksums alone.
  • Fail closed when verification fails; do not fall back automatically to executing an unverified script.
  • Document the exact permissions and filesystem changes required by the installer, and ensure it runs without administrator or root privileges unless a narrowly defined operation genuinely requires elevation.
  • For automated environments, pin both the installer version and expected digest rather than retrieving a mutable latest-version script.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill recommends installing software via a remote script piped directly into a shell (curl ... | bash), which executes code from the network without prior inspection or integrity verification. If the remote host, transport, or distribution path is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description activates the skill for "ANY Feathery request," including reading, creating, updating, and deleting data, without narrowing scope or giving exclusion conditions. This is broad enough to capture a wide range of ordinary mentions of Feathery and may cause unintended invocation whenever Feathery is involved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.