ClawHub
Back to skill

Security audit

FundzWatch

Security checks for vulnerabilities and agentic risk

Overview

The skill's normal FundzWatch connector use is coherent, but its setup path tells users or agents to execute unverified remote installer scripts.

Review this skill before installing if you do not already trust OOMOL's installer delivery. Prefer installing the oo CLI through a verified, signed, or checksum-validated method, and do not run the remote shell or PowerShell installer in an elevated session unless you independently intend to grant that access.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:69
Finding

Unverified Remote Shell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 69
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command downloads a mutable shell script from an external server and immediately passes it to Bash. The remote content is not pinned to a reviewed version, saved for inspection, or verified using a cryptographic signature or trusted digest.

HTTPS provides transport protection but does not establish that the retrieved script is the same artifact that was reviewed. Compromise of the distribution server, publishing account, or delivery infrastructure—or a legitimate replacement of the hosted script—could change the effective payload without changing this Skill.

Installing the CLI may be necessary for first-time use, but immediate execution of unverified remote code exceeds the minimum privilege needed to explain or initiate installation. It is also outside the declared allowed-tools: [Bash(oo *)] boundary because the installation command invokes curl and bash, rather than an existing oo command.

Attack Path

  1. The oo CLI is absent and an invocation fails with oo: command not found.
  2. The user or agent follows the documented first-time setup command.
  3. curl retrieves the current content of https://cli.oomol.com/install.sh.
  4. The content is streamed directly into Bash without inspection or integrity verification.
  5. If the hosted installer or its delivery infrastructure has been compromised, attacker-controlled shell commands execute with the privileges of the invoking user.

Impact Assessment

A malicious installer could perform arbitrary actions available to the invoking user, including reading or modifying accessible files, collecting user-level credentials, altering shell configuration, installing addition ...[truncated 315 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation pipeline.
  • Prefer a trusted operating-system package manager or signed release package with a pinned version.
  • If manual installation is necessary, download a versioned artifact to disk first.
  • Verify the artifact using a publisher signature or a SHA-256 digest obtained through an independently trusted channel.
  • Allow the user to inspect the downloaded script before executing it.
  • Keep CLI installation as an explicit manual prerequisite rather than automatically executing it from the Skill.
  • Update the declared tool permissions or setup architecture so installation does not silently exceed the Bash(oo *) boundary.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:73
Finding

Unverified Remote PowerShell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 73
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This command uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script from an external URL and passes the response directly to Invoke-Expression (iex). The downloaded script is executed without version pinning, local inspection, signature validation, or digest verification.

This is the PowerShell equivalent of a download-to-shell pipeline. The effective executable content is controlled by the remote endpoint and can change after the Skill has been audited. TLS does not mitigate compromise of the publisher, hosting environment, or release process.

Although installing the CLI can be required for first-time setup, immediate interpretation of unverified network content is not the least-privileged installation approach. It grants the downloaded script access to all resources available to the PowerShell process.

Attack Path

  1. A Windows user discovers that the oo CLI is unavailable.
  2. The user follows the documented PowerShell setup instruction.
  3. irm downloads the current contents of https://cli.oomol.com/install.ps1.
  4. The pipeline forwards the response directly to iex.
  5. iex evaluates the remote content as PowerShell code.
  6. If the installer or delivery infrastructure is compromised, attacker-controlled commands execute in the user's PowerShell session.

Impact Assessment

Exploitation provides arbitrary code execution with the privileges of the invoking Windows user. A malicious payload could access user-readable files, steal credentials available to that session, modify the user profile, install additional payloads, or configure user-level persistence. The documented command does not itself req ...[truncated 291 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Distribute the CLI through a reputable signed package mechanism, such as a trusted package manager or signed installer.
  • Pin installation instructions to a specific reviewed release.
  • Download the installer to a local file before execution.
  • Validate its Authenticode signature or verify a published cryptographic digest through an independently trusted channel.
  • Present the artifact for inspection and require an explicit manual execution step.
  • Document that installation should occur in a non-elevated session unless elevated privileges are demonstrably required.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill recommends installing software by piping a remote script directly into a shell (curl ... | bash), which executes unverified code from the network with the user's privileges. If the remote host, CDN path, TLS trust chain, or installation script is compromised, this becomes an immediate arbitrary code execution vector; in a skill context, this is more dangerous because the skill may normalize unsafe operator behavior during error handling.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY FundzWatch request" and "Whenever a task involves FundzWatch," which is a very broad activation condition without boundaries or exclusions. For a markdown skill description, this can cause unintended invocation on casual mentions or loosely related tasks because no negative examples or scope constraints are provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.