ClawHub
Back to skill

Security audit

HARPA AI

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its HARPA AI integration purpose, but it needs review because setup can run downloaded installer code and the HARPA action surface includes destructive commands.

Review the installer path before use: prefer verified OOMOL installation instructions, avoid running remote install scripts blindly, and require explicit approval before any HARPA command that may change, overwrite, delete, or act through a connected browser session.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
97% confidence
Finding
The skill instructs users to install software via a direct network fetch piped into a shell (`curl ... | bash`), which executes remote code without prior verification. If the distribution endpoint, DNS, TLS trust chain, or served script is compromised, this can lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger text is overly broad because it instructs the agent to route ANY HARPA AI-related request through this skill, including read, write, and destructive operations. Broad mandatory routing increases the chance the skill is invoked in inappropriate contexts and can bypass safer, narrower tooling or decision logic, especially since the skill exposes state-changing actions.

Static analysis

No suspicious patterns detected.