ClawHub
Back to skill

Security audit

Heyy

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Heyy connector, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the oo CLI installation path before installing. Prefer downloading from an official, versioned source, checking signatures or checksums when available, and avoiding direct pipe-to-shell execution. Also confirm exact payloads before allowing the skill to create or update Heyy data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote Shell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Remote payload retrieval and execution through a pipe-to-shell installer
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable script from an external URL and immediately passes the response to Bash. It does not pin an installer version, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution.

Although cli.oomol.com is consistent with the declared OOMOL integration, the repository contains no evidence that the delivered script is immutable or independently authenticated. Compromise of the hosting service, release pipeline, domain, or trusted network path could therefore turn this documented setup command into an arbitrary-code execution channel.

This behavior exceeds the minimum privilege needed for routine Skill operation. Normal execution is restricted to Bash(oo *), while this setup instruction launches a general-purpose shell against externally supplied content. The actual privileges available to the payload are those of the user executing the installation command.

Attack Path

  1. The oo CLI is absent, causing the user or agent to follow the first-time setup instructions.
  2. An attacker compromises the installer, its hosting infrastructure, or another trusted part of its delivery chain.
  3. curl retrieves the attacker-controlled response from the documented URL.
  4. The pipe forwards the response directly to Bash without integrity verification.
  5. Bash executes the payload with the invoking user's privileges.
  6. The payload can access or modify resources available to that user and may install additional components or persistence mechanisms.

Impact Assessment

Successful exploitation provides arbitrary ...[truncated 500 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Prefer a trusted platform package manager or a version-pinned release artifact from the official project.
  • Download the installer to a local file as a separate step rather than piping it directly into a shell.
  • Publish a cryptographic checksum or signed release manifest through an independently protected channel.
  • Verify the checksum and, where available, the publisher's digital signature before execution.
  • Let the user inspect the downloaded script and require explicit approval before running it.
  • Pin the installer or CLI to a reviewed version instead of retrieving a mutable latest-version endpoint.
  • Document the exact filesystem and system permissions required by installation and recommend execution as an unprivileged user.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding

Unverified Remote PowerShell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 67
Vulnerability Type: Remote payload retrieval and execution through PowerShell expression evaluation
Risk Level: Critical

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

irm retrieves content from a mutable external URL, and iex evaluates that content as PowerShell code immediately. No release version is pinned, no checksum or publisher signature is verified, and no local review step separates retrieval from execution.

The referenced host is related to the declared OOMOL service, but that relationship does not establish the continuing integrity of the remotely delivered script. If the installer or delivery infrastructure is compromised, the effective code executed by this instruction can change after the Skill has been reviewed.

This setup path also bypasses the narrow runtime intent represented by Bash(oo *): instead of invoking only the expected CLI, it grants downloaded content access to a general-purpose command interpreter. The payload receives the privileges of the PowerShell process used to run the command.

Attack Path

  1. A Windows user cannot find the oo command and follows the documented setup procedure.
  2. An attacker alters the hosted PowerShell installer or compromises its release or delivery infrastructure.
  3. Invoke-RestMethod retrieves the modified response.
  4. The pipeline sends the response directly to Invoke-Expression.
  5. PowerShell evaluates the attacker-controlled content without integrity validation.
  6. The payload performs arbitrary actions allowed by the current Windows user and may attempt additional privilege escalation or persistence.

Impact Assessment

Successful exploitation enables arbitrary PowerShell execution in the invoking user's context. Potential consequences include reading accessible files and crede ...[truncated 362 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pattern.
  • Distribute a version-pinned, Authenticode-signed PowerShell script or signed installer package through the official release process.
  • Download the artifact to disk separately and validate both its cryptographic checksum and publisher signature before execution.
  • Require explicit user approval after displaying the source, version, expected publisher, and requested permissions.
  • Prefer a trusted Windows package manager with package integrity and publisher verification.
  • Avoid mutable installer URLs; use an immutable release URL associated with a reviewed version.
  • Run installation without administrative privileges unless a documented operation strictly requires elevation.
  • Document expected filesystem, registry, network, and persistence changes so users can verify the installer's behavior.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a shell pipeline that downloads a remote script and executes it directly via bash, which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, CDN, or publisher is compromised, users may run attacker-controlled code on their machine with the skill's implied authority.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Heyy request" and "Whenever a task involves Heyy," which is extremely broad and lacks clear boundaries or exclusion conditions. For a manifest/markdown file, this creates an ambiguous trigger scope that could overlap with many ordinary requests involving Heyy without specifying when the skill should not be used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.