ClawHub
Back to skill

Security audit

Formspree

Security checks for vulnerabilities and agentic risk

Overview

This Formspree skill is mostly coherent, but its first-time setup tells users or agents to run unverified remote installer scripts.

Review this skill before installing. It appears intended for Formspree submission access through OOMOL, but do not let an agent automatically run the documented curl-to-bash or PowerShell iex installer; install the oo CLI through a verified, trusted method and understand what data your Formspree connection exposes to OOMOL.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:55
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–59
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from an external server and pass them directly to a command interpreter. Neither command pins a script version, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded content before execution.

The package contains no local copy of either installer, so their effective behavior cannot be established through this audit. Even if the referenced domain is currently legitimate, compromise of its hosting account, deployment process, DNS, or other supply-chain infrastructure could cause these instructions to execute attacker-controlled code.

Installing a CLI is relevant to the skill's operation, but immediate remote-script execution is not the minimum privilege or safest mechanism necessary to perform that installation. The risk is especially significant in an agent skill because the documented fallback may be followed after an oo: command not found error.

Attack Path

  1. The oo CLI is absent, and an attempted connector command fails with oo: command not found.
  2. A user or automation follows the first-time setup instructions in SKILL.md.
  3. The command retrieves a mutable script from cli.oomol.com.
  4. An attacker who has compromised the remote distribution path supplies modified installer content.
  5. bash or PowerShell executes that content immediately under the invoking user's identity.
  6. The payload can access resources available to that user and may install additional components or persistence mechanisms.

Impact Assessment

Successful exploitatio ...[truncated 669 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove direct curl | bash and irm | iex execution patterns.
  • Prefer an official package manager or a versioned release artifact from a documented trusted source.
  • Pin the installer or binary to a specific release version rather than retrieving a mutable endpoint.
  • Publish expected SHA-256 checksums and require verification before execution.
  • Cryptographically sign release artifacts and document signature verification against a pinned, independently distributed public key.
  • Download installers to a local file first, allowing inspection before execution.
  • Require explicit user approval before running any downloaded installer; an agent should not perform this setup automatically after a command failure.
  • Run installation with ordinary user privileges unless a clearly documented operation strictly requires elevation.
  • Document the files, directories, network endpoints, and configuration changes made by the installer.
  • Apply equivalent controls to both the Unix shell and PowerShell installation procedures.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to execute a remote installation script via curl ... | bash, which runs code fetched over the network without verification. In a skill context this is especially dangerous because it normalizes arbitrary shell execution as part of setup, creating a straightforward path to supply-chain compromise or remote code execution if the host, transport, or distribution channel is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest and description frame the skill as suitable for 'searching and reading data,' but the body gives generic instructions for invoking any connector action, including [write] and [destructive] operations. This mismatch can mislead an agent or user into trusting the skill for read-only use while still enabling state-changing operations if additional actions are exposed by the connector.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger text says to use this skill for ANY Formspree request and instead of calling the API directly, which is overly broad and can cause unintended invocation outside the narrow listed use case. In an agent setting, broad routing language can bypass more appropriate skills or direct handling, increasing the chance of excessive access or unintended data exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.