ClawHub
Back to skill

Security audit

HTML to Image

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrowly scoped HTML-to-image connector, with a setup-time install command users should review before running.

Before installing, review the OOMOL CLI installer or use the official install guide if available. Only connect the intended HTML to Image account/API key, and avoid sending private secrets in HTML, CSS, or URLs because the connector returns hosted image output.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
97% confidence
Finding
The skill instructs users to install software via `curl ... | bash`, which executes a remote script directly from the network without prior verification. If the install endpoint, transport path, or hosting environment is compromised, this can lead to arbitrary code execution on the user's machine; the skill context makes this more dangerous because the command is presented as a recommended first-time setup step inside an operational workflow.

Static analysis

No suspicious patterns detected.