ClawHub
Back to skill

Security audit

GetProspect

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for GetProspect access, but its setup instructions tell users to run unverified internet install scripts, so it should be reviewed before installing.

Install only if you are comfortable trusting OOMOL's installer endpoint and the oo CLI. Prefer installing the CLI through a verified release or package-manager path, and avoid running curl-to-shell or irm-to-iex commands without inspecting and verifying the installer first.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe content retrieved from external OOMOL endpoints directly into Bash or PowerShell. Neither command pins the installer to a reviewed release nor verifies a cryptographic signature or checksum before execution.

This creates a remote code-execution channel whose effective payload can change after the Skill package has been audited. HTTPS authenticates the endpoint and protects data in transit under normal conditions, but it does not establish that future responses contain the same reviewed code. Compromise of the distribution server, its deployment process, DNS or certificate infrastructure, or an authorized publisher account could therefore turn the installation command into arbitrary code execution.

Installing a missing CLI is not part of the Skill's normal GetProspect query operation and is only described as an error-recovery step. Immediate execution of an unverified network response exceeds the minimum privilege and trust necessary to provide installation guidance.

Attack Path

  1. The oo CLI is unavailable, causing the agent or user to follow the first-time setup instructions.
  2. An attacker compromises or gains control over the installer endpoint or its publishing pipeline.
  3. The endpoint supplies a modified shell or PowerShell script.
  4. curl | bash or irm | iex passes the response directly to the relevant command interpreter.
  5. The malicious response executes without local review, version pinning, signature validation, or integrity verification.
  6. The payload performs arbitrary actions within the privile ...[truncated 746 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all curl | bash and irm | iex installation instructions.
  2. Direct users to a version-pinned release hosted on the official repository or a trusted operating-system package manager.
  3. Download the installer or release artifact to a local file rather than executing the network response directly.
  4. Publish a cryptographic checksum and, preferably, a signed release manifest through an independently protected channel.
  5. Verify the artifact's signature and checksum before execution, failing closed if verification does not succeed.
  6. Allow the user to inspect the downloaded script and require explicit approval before executing it.
  7. Run installation with ordinary user privileges unless a documented operation strictly requires elevation.
  8. Prefer a packaged binary with reproducible build information and a pinned version over a mutable installation script.
  9. Keep installation outside automated Skill execution; on a missing CLI, report the prerequisite and safe installation options rather than executing an installer automatically.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remotely fetched script without prior verification. If the distribution server, DNS/TLS path, or install script is compromised, this can lead to arbitrary code execution on the host running the skill.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says to use this skill for "ANY GetProspect request" and "Whenever a task involves GetProspect," which is a very broad activation condition without boundaries or negative examples. In a manifest/markdown context, this can overlap with many loosely related tasks and does not clearly specify when the skill should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.