ClawHub
Back to skill

Security audit

Hookdeck

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing Hookdeck through OOMOL, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the installer path before installing. Prefer installing the oo CLI from a signed or verifiable release, and only connect the OOMOL Hookdeck integration if you are comfortable letting OOMOL broker Hookdeck actions. Treat create, update, and delete actions as account-changing operations and approve exact targets and payloads before running them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:69
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69-73
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions retrieve mutable scripts from external URLs and immediately execute their contents using Bash or PowerShell. Neither command pins a release version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded content before execution.

Although installing the oo CLI supports the Skill's declared functionality, piping a network response directly into a command interpreter is not the minimum safe privilege or trust model required for installation. The effective code is controlled outside the reviewed project and may change after this Skill has been audited.

The instructions also use failure-suppressing or compact execution patterns. In particular, curl -fsSL produces little visible output, while PowerShell's irm ... | iex directly evaluates the response. A compromise of the distribution server, publishing process, DNS/TLS trust path, or upstream account could therefore turn these documented setup steps into arbitrary code execution.

Attack Path

  1. The oo command is unavailable, causing the agent or user to follow the first-time setup instructions.
  2. An attacker compromises the remote installer endpoint, its release infrastructure, or another part of the trusted delivery path.
  3. The installer URL returns attacker-controlled shell or PowerShell code.
  4. bash or iex executes the response immediately without integrity or authenticity verification.
  5. The payload performs arbitrary actions with the permissions of the invoking user or agent process.

...[truncated 1046 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove both direct network-to-interpreter pipelines.
  2. Prefer installation through a trusted operating-system package manager or another repository that provides signed, versioned packages.
  3. Pin the CLI to a specific reviewed release rather than retrieving a mutable installer from a generic URL.
  4. If a standalone installer is necessary, download it to a local file without executing it:
    • Use a version-specific HTTPS URL.
    • Verify a cryptographic signature from a separately established trust root.
    • Verify a published SHA-256 or stronger checksum obtained through an independent authenticated channel.
    • Display the resolved version, source, and verification result to the user.
  5. Require explicit user approval before executing the verified installer.
  6. Run installation with the least-privileged account possible and do not request administrative privileges unless a documented installation step strictly requires them.
  7. Publish reproducible installer sources and document the expected file changes so users can inspect and validate the installation behavior.
  8. Treat integrity-verification failure, redirects to unexpected hosts, or unavailable signatures as fatal errors rather than falling back to direct execution.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell, which creates a classic supply-chain and arbitrary code execution risk. If the install endpoint, transport, hosting, or upstream release process is compromised, the user may execute attacker-controlled code immediately on their system.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says to use this skill for "ANY Hookdeck request" and "Whenever a task involves Hookdeck," which is an unusually broad trigger without constraints or exclusion examples. This can cause the skill to activate for loosely related mentions of Hookdeck rather than clearly scoped actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.