ClawHub
Back to skill

Security audit

HR Partner

Security checks for vulnerabilities and agentic risk

Overview

This HR Partner connector is mostly coherent, but its setup instructions tell users to run unverified remote installer scripts.

Install only if you trust OOMOL and are comfortable connecting an HR Partner account that can expose sensitive personnel and recruiting records. Do not run the remote installer commands blindly; prefer verified, pinned installation instructions or inspect and verify the installer before execution.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote Installer Download and Immediate Shell Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions download mutable content from an external server and pass it directly to a command interpreter. The Bash command pipes the HTTP response into bash, while the PowerShell command passes it to Invoke-Expression.

Neither command pins an installer version, verifies a cryptographic signature or checksum, nor provides an opportunity to inspect the downloaded artifact before execution. HTTPS protects the connection in transit but does not guarantee that the hosted payload remains unchanged or benign. Compromise of the domain, hosting infrastructure, release process, or publisher account could therefore turn these documented installation commands into an arbitrary-code execution channel after the Skill has already been reviewed.

This behavior exceeds the minimum privileges required to document or invoke the HR Partner connector. Installing a required CLI may be legitimate, but immediate execution of an unverified remote response is not necessary. The risk is partially constrained by the declared Bash(oo *) tool allowlist if that restriction is correctly enforced; however, the commands remain unsafe instructions for users or environments that execute them outside that allowlist.

Attack Path

  1. The oo CLI is absent, causing an oo: command not found error.
  2. An agent operator or user follows the documented first-time setup procedure.
  3. An attacker compromises the installer host, its publishing process, DNS resolution, or another trusted delivery component.
  4. The external endpoint returns attacker-controlled shell o ...[truncated 1064 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all curl | bash and Invoke-Expression installation patterns.
  2. Pin installation instructions to a specific, reviewed CLI release rather than a mutable installer endpoint.
  3. Download the artifact to a local file without executing it:
    • Use curl --proto '=https' --tlsv1.2 --location --output installer.sh URL on Unix-like systems.
    • Use Invoke-WebRequest -OutFile installer.ps1 URL on Windows.
  4. Publish and require verification of a SHA-256 or stronger digest obtained through an independently protected release channel.
  5. Prefer cryptographic release signatures and verify them against a documented, pinned publisher key.
  6. Instruct users to inspect the downloaded installer before executing it.
  7. Prefer a trusted operating-system package manager with repository signing and explicit version pinning.
  8. Keep installation outside automated Skill execution. The Skill should report that the dependency is missing and direct the user to reviewed installation documentation.
  9. Continue enforcing the Bash(oo *) allowlist so that the Skill cannot invoke download tools or arbitrary shells.
  10. Apply least privilege during installation and explicitly warn users not to execute the installer as root or administrator unless a documented component strictly requires it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs running a remote install script via 'curl ... | bash', which executes code fetched from the network without verification. If the distribution endpoint, DNS, TLS trust chain, or hosting account is compromised, users or agents could execute attacker-controlled code on the local system.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger text says to use this skill for 'ANY HR Partner request' and 'instead of calling the API directly,' which is overly broad and can cause the agent to route routine or ambiguous HR-related tasks into this skill automatically. In a connector-backed skill with access to employee and applicant data, over-invocation increases the chance of unnecessary access to sensitive HR information or misuse of available actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest and description promise this skill is for 'searching and reading data', but the body explicitly allows write-capable and destructive actions. That mismatch can mislead upstream policy, routing, or user expectations and may cause an agent to invoke state-changing operations under a read-only trust assumption.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.