ClawHub
Back to skill

Security audit

Getform

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Getform use, but its first-time setup instructs direct execution of unverified remote installer scripts.

Install only if you are comfortable with OOMOL mediating Getform access and with manually reviewing the oo CLI installation path. Do not let an agent run the curl|bash or irm|iex setup commands automatically; prefer a verified installer, pinned release, or checksum/signature workflow. Confirm the exact submit_form payload before any write action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:56
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from cli.oomol.com and immediately execute their contents using Bash or PowerShell. Neither command pins an immutable release, validates a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded script before execution.

The domain is consistent with the declared OOMOL integration, but the project contains no local evidence that establishes the integrity of the remotely served scripts. The effective code can change after this Skill has been reviewed. Compromise of the hosting infrastructure, distribution pipeline, domain, or trusted TLS path could therefore turn these commands into an arbitrary code-execution channel.

Installing the required CLI may be necessary during first-time setup, but executing a mutable remote response directly in a shell exceeds the minimum privileges necessary. A pinned and cryptographically verified package can provide the same functionality without granting an unreviewed network response immediate shell execution.

Attack Path

  1. The oo CLI is unavailable, causing the documented first-time setup fallback to apply.
  2. An agent or user follows the installation command in SKILL.md.
  3. The command downloads the current contents of install.sh or install.ps1.
  4. Bash or PowerShell executes the response immediately without integrity verification.
  5. If the remote source or delivery chain has been compromised, attacker-controlled commands run with the privileges of the invoking user.
  6. Those commands can modify accessi ...[truncated 808 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash and irm | iex installation patterns.
  2. Pin installation instructions to a specific CLI version and immutable release artifact.
  3. Publish an expected SHA-256 or stronger checksum and verify it locally before execution.
  4. Prefer signed packages distributed through trusted platform package managers.
  5. If a standalone script is unavoidable, download it to a local file, verify its signature or checksum, display its source and version, and require explicit user approval before execution.
  6. Run installation with ordinary user privileges unless a narrowly defined operation genuinely requires elevation.
  7. Document the expected filesystem and configuration changes made by the installer.
  8. Keep setup conditional on an actual missing-command error, as already stated in the Skill, rather than invoking installation proactively.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software by piping a remote script directly into bash, which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, or hosting is compromised, arbitrary code would run immediately on the user's machine without inspection; the presence of an alternative PowerShell one-liner shows the same unsafe pattern on another platform.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says to use this skill for ANY Getform request and whenever a task involves Getform, which is an overly broad trigger that can cause the agent to invoke this skill on vague mentions rather than clear user intent. In a skill that includes write-capable actions, over-invocation increases the chance of unnecessary data access or accidental state-changing operations, especially if the agent follows the skill automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.