ClawHub
Back to skill

Security audit

Google Search Console

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Google Search Console use, but its fallback setup tells agents to run unverified remote installer scripts directly in a shell.

Review this skill before installing. The Google Search Console actions are documented and write/destructive operations require confirmation, but avoid letting an agent run the listed installer commands directly; install the oo CLI through a verified, version-pinned, checksum-checked method instead.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The first-time setup instructions provide remote-installation commands for both macOS/Linux and Windows:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both commands retrieve mutable content from an external server and pass it directly to a command interpreter. The instructions do not pin an installer version, verify a cryptographic checksum or digital signature, or provide an opportunity to inspect the downloaded script before execution.

HTTPS protects the connection in transit under normal conditions, but it does not establish that the current installer content is the same content that was reviewed. Consequently, compromise of the distribution server, its deployment pipeline, domain, or trusted TLS infrastructure could change the effective code executed by users without modifying this Skill.

Installing the required CLI is relevant to the declared functionality, but immediate pipe-to-shell execution is not the minimum-risk installation method. A separately downloaded, version-pinned, cryptographically verified artifact would provide the same functionality with a substantially smaller supply-chain risk.

Attack Path

  1. A user or agent attempts to use the Skill on a system where the oo CLI is unavailable.
  2. The command fails with oo: command not found, causing the first-time setup instructions to be followed.
  3. An attacker compromises the remote installer, hosting environment, release pipeline, domain resolution, or another trusted delivery component.
  4. The external endpoint returns an attacker-controlled shell or PowerShell script.
  5. bash or iex executes the response immediately, without integrity ...[truncated 950 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove instructions that pipe network responses directly into bash or iex.
  2. Prefer a trusted platform package manager or an official, version-pinned release artifact.
  3. Require the installer to be downloaded to a local file before execution.
  4. Publish a SHA-256 or stronger checksum through an independently protected release channel and require verification before running the installer.
  5. Digitally sign release artifacts and document signature verification using a pinned publisher key.
  6. Pin the installer or CLI to a reviewed version rather than retrieving mutable content from an unversioned URL.
  7. Execute installation with ordinary user privileges whenever possible and clearly identify any operation that genuinely requires elevation.
  8. Provide commands equivalent to the following secure workflow:
bash
curl -fSLo oo-install.sh "https://trusted.example/releases/vX.Y.Z/install.sh"
echo "<expected-sha256>  oo-install.sh" | sha256sum --check -
less oo-install.sh
bash oo-install.sh

For Windows, use an equivalent workflow based on Invoke-WebRequest, Get-FileHash, signature validation, manual inspection, and separate execution.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
94% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification and executes whatever the remote server returns at runtime, creating a supply-chain/code-execution risk if the host, network path, DNS, TLS trust, or distribution endpoint is compromised.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Static analysis

No suspicious patterns detected.