ClawHub
Back to skill

Security audit

HeyReach

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using HeyReach through OOMOL, but its setup instructions include unverified remote installer commands that can execute changing external code on the user's machine.

Review the OOMOL oo CLI installation path before installing. Prefer official, version-pinned installers with checksum or signature verification instead of pipe-to-shell commands, and confirm any HeyReach write action payload before it runs.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions retrieve mutable scripts from external URLs and immediately execute them through Bash or PowerShell. Neither command pins a release version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded script before execution.

HTTPS protects data in transit but does not guarantee that the published payload is trustworthy or immutable. Compromise of the hosting service, publishing pipeline, DNS resolution, certificate infrastructure, or upstream account could cause these commands to execute attacker-controlled content. The effective code can also change after the Skill itself has been reviewed.

Installation is relevant to the declared functionality because the Skill depends on the oo CLI. However, executing an unverified remote payload exceeds the minimum privilege and trust necessary to install that dependency safely. The same risk exists on both supported shell environments.

The connector commands also transmit user-supplied JSON and receive HeyReach data through OOMOL. That network transfer is disclosed and necessary for the connector-based functionality; the reviewed file contains no evidence that it collects local credential files, handles raw HeyReach tokens, or sends data to an unrelated endpoint.

Attack Path

  1. A user or agent attempts to invoke the Skill when the oo CLI is unavailable.
  2. The documented fallback directs it to execute one of the remote installation commands.
  3. The command downloads the current contents of install.sh or install.ps1.
  4. The downloaded content ...[truncated 1103 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both pipe-to-shell installation commands.
  2. Pin the oo CLI to a specific, reviewed release rather than downloading an unversioned installer.
  3. Download the release artifact to a local file as a separate step.
  4. Publish the expected SHA-256 digest through an independently protected channel and verify it before execution.
  5. Prefer publisher-signed packages and verify the signature against a documented, pinned public key.
  6. Permit inspection of the downloaded installer before running it; do not pass network responses directly to a command interpreter.
  7. Use a trusted operating-system package manager or a documented official release archive where possible.
  8. Run installation with ordinary user privileges and request elevation only for narrowly scoped operations that demonstrably require it.
  9. Fail closed if checksum or signature verification fails, and delete the untrusted artifact without executing it.
  10. Document the exact domains contacted, files modified, and permissions required by installation so users can assess the operation before approval.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell, which is a well-known supply-chain risk. If the remote server, transport path, or hosted script is compromised, arbitrary code would execute immediately on the user's system with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY HeyReach request" and "Whenever a task involves HeyReach," which is an expansive activation condition rather than a narrowly bounded trigger. It does not provide exclusion conditions or negative examples, so routine mentions of HeyReach could unintentionally invoke the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.