ClawHub
Back to skill

Security audit

Genderize

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Genderize connector, but its first-time setup tells an agent to run an unverified remote installer directly in a shell.

Install only if you are comfortable with OOMOL as a connector provider and with names/country hints being sent through that service. Do not let an agent run the listed curl-to-bash or PowerShell iex installer automatically; install the oo CLI through a verifiable method and review any login or connection steps yourself.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:56
Finding

Unverified Remote Installer Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions pipe mutable content retrieved from cli.oomol.com directly into Bash or PowerShell. The commands do not pin an installer version, verify a cryptographic signature or checksum, preserve the downloaded artifact for inspection, or otherwise validate the code before executing it.

Installation of the oo CLI supports the Skill's declared functionality, but immediate pipe-to-shell execution is not necessary. The same installation can be performed by downloading a pinned artifact, validating its integrity and publisher, and then executing it separately.

Because the effective code resides outside the reviewed project and may change at any time, the reviewed SKILL.md does not determine what commands will ultimately run. Compromise of the hosting domain, installer publication process, DNS or TLS trust chain, or OOMOL infrastructure could turn these instructions into an arbitrary-code-execution channel.

The project contains no local executable scripts, so this finding is limited to the remote installation instructions. The separately identified transmission of names and optional country information through the OOMOL Genderize connector is disclosed and necessary for the declared remote prediction service; the audited content provides no evidence of unrelated data exfiltration.

Attack Path

  1. An attacker compromises the installer host, publication pipeline, or another component capable of changing the response from https://cli.oomol.com/install.sh or install.ps1.
  2. The oo command is unavailable, causing a user or agent to follo ...[truncated 894 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation patterns.
  2. Prefer an official platform package manager or a signed, version-pinned release artifact.
  3. Download the installer to a local file without executing it:
    • Use a fixed versioned URL rather than a mutable generic installer endpoint.
    • Disable redirects where practical, or validate the final destination against an allowlist.
  4. Publish and verify a SHA-256 checksum over a trusted, independently delivered channel.
  5. Verify a cryptographic signature tied to a documented publisher key before execution.
  6. Allow the user to inspect the downloaded artifact, then execute it as a separate explicit step.
  7. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation.
  8. Document the files, network endpoints, and configuration changes made by the installer.
  9. For automated environments, pin both the CLI version and expected digest so a changed payload fails closed.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote-code-execution risk: if the install endpoint is compromised, intercepted, or serves unexpected content, arbitrary code would execute on the host running the skill.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Genderize request," which is a very broad activation condition without examples of when not to invoke it. In a manifest/markdown context, this lacks trigger constraints or negative examples and could cause the skill to activate too broadly whenever Genderize is mentioned.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.