ClawHub
Back to skill

Security audit

Grist

Security checks for vulnerabilities and agentic risk

Overview

The Grist connector is coherent, but its setup instructions include running a live internet installer directly in a shell without verification.

Install only if you trust OOMOL and are comfortable reviewing or replacing the remote installer step with a safer verified installation path. Once configured, use extra care with update and delete actions because they can change or remove Grist records.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote Installer Download and Immediate Shell Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions download mutable scripts from an external server and immediately execute them through Bash or PowerShell. Neither command pins the installer to a specific release nor verifies a cryptographic signature or checksum before execution. The user and Agent therefore cannot confirm that the executed code matches the version reviewed when the Skill was published.

The download domain is consistent with the declared OOMOL service, and installation is only presented as a fallback when the oo command is unavailable. Nevertheless, direct remote-script execution is not required for normal Grist connector operations and exceeds the minimum privileges needed at runtime. The effective payload can change independently of the audited SKILL.md.

Attack Path

  1. The oo CLI is absent, causing an oo: command not found error.
  2. The Agent or user follows the first-time setup instructions.
  3. curl or Invoke-RestMethod retrieves a mutable installer from cli.oomol.com.
  4. The response is passed directly to Bash or Invoke-Expression without local inspection or integrity verification.
  5. If the hosting infrastructure, release process, DNS resolution, or TLS trust path is compromised, attacker-controlled commands execute with the privileges of the invoking user.
  6. The payload could then read accessible files and credentials, alter local configuration, install persistence, or invoke additional network resources.

Impact Assessment

Successful exploitation permits arbitrary code execution under the invoking user's account. The accessi ...[truncated 523 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all pipe-to-shell and Invoke-Expression installation instructions.
  2. Direct users to an official package manager or a version-pinned release artifact from the official repository.
  3. Require the installer to be downloaded to a local file before any execution.
  4. Publish a SHA-256 checksum and, preferably, a cryptographic signature for every supported installer version.
  5. Verify the checksum and signature against metadata obtained through a separately protected channel.
  6. Allow the user to inspect the downloaded script before execution.
  7. Require explicit user approval before installing software or executing an installer.
  8. Run installation with ordinary user privileges unless a documented component strictly requires elevation.
  9. Prefer commands similar to the following workflow:
bash
curl -fSLo install.sh "https://cli.oomol.com/releases/vPINNED_VERSION/install.sh"
echo "EXPECTED_SHA256  install.sh" | sha256sum --check -
less install.sh
bash install.sh

The release version and checksum must be genuine, pinned values published and maintained by the vendor; placeholders must not be used operationally.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This is dangerous because it executes unverified code from the network with the user's privileges, creating a supply-chain and remote code execution risk if the host, script, transport, or distribution path is compromised.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description uses the activation condition "Use this skill for ANY Grist request," which is extremely broad and does not define meaningful boundaries for when the skill should or should not be invoked. Without exclusions or negative examples, this could overlap with many routine mentions of Grist and cause unintended activation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.