ClawHub
Back to skill

Security audit

Formaloo

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for Formaloo, but its fallback setup tells agents to run unverified remote installer scripts, which needs review before use.

Install only if you are comfortable with OOMOL as an intermediary for Formaloo and avoid running the remote installer pipeline directly; prefer a verified or package-manager installation of the oo CLI, and require explicit confirmation before creating, updating, or deleting Formaloo data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from an external server and execute the responses immediately using Bash or PowerShell. They do not pin a release, inspect the downloaded content, or verify a cryptographic checksum or publisher signature before execution.

Although cli.oomol.com is consistent with the declared OOMOL service, trust in the domain alone does not establish the integrity of each downloaded payload. A compromise of the hosting infrastructure, release pipeline, domain, or relevant DNS/TLS trust chain could replace the installer with attacker-controlled code after the Skill has already been reviewed.

Installing the CLI is only a fallback when oo is unavailable, but arbitrary remote-script execution exceeds the minimum mechanism necessary to install a client. A signed, version-pinned artifact installed after verification would provide the required functionality with substantially less supply-chain risk.

The ordinary network behavior of oo connector run, which transmits a user-supplied JSON payload to the declared Formaloo connector, is consistent with the Skill's stated remote-service functionality. The reviewed file contains no evidence that it intentionally collects raw credentials, private keys, environment variables, or unrelated local files.

Attack Path

  1. An attacker compromises the remote installer, its hosting or release infrastructure, or a component of the network trust chain.
  2. The victim invokes the Skill on a system where the oo command is not installed.
  3. The documented first-time setup fallback is followed.
  4. `curl ...[truncated 922 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both direct pipe-to-shell installation commands.
  2. Pin the CLI to a specific reviewed release and download the installer or binary as a file without automatically executing it.
  3. Publish expected SHA-256 or stronger cryptographic digests through a separately protected release channel and verify them before installation.
  4. Prefer signed release artifacts and verify the publisher signature using a pinned, trusted public key.
  5. Use a reputable package manager with version pinning and signature verification where available.
  6. Display the resolved version, source URL, checksum, and intended installation changes, then obtain explicit user approval before executing the installer.
  7. Perform installation with ordinary user privileges unless a specific installation step demonstrably requires elevation.
  8. If retaining an installer script is unavoidable, download it first, verify its integrity, allow inspection, and execute the verified local file rather than piping a live network response into a shell.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into bash, which executes unverified code from the network with the user's shell privileges. If the install endpoint, transport, or upstream distribution is compromised, this becomes a straightforward remote code execution path; in a skill context, it is especially risky because the instructions are presented as a remediation path after a tool failure.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text says to use this skill for ANY Formaloo request and instead of calling the API directly, which is overly broad and can cause automatic invocation in situations where a narrower or safer path should be chosen. Broad routing language increases the chance of unintended reads, writes, or destructive actions being surfaced or executed under minimal scrutiny, especially because this skill includes state-changing capabilities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.