ClawHub
Back to skill

Security audit

Imgix

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing Imgix through OOMOL, but its setup instructions include unverified remote installer commands that could execute mutable code on a user's machine.

Review the installer path before installing. Prefer downloading the oo CLI from a verified release or package manager and checking publisher integrity before running it. Once installed, only approve Imgix write or purge actions after confirming the exact target and payload.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installer Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–62
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from cli.oomol.com and pass their contents directly to Bash or PowerShell. The commands do not pin an installer version or verify a cryptographic signature or checksum before execution. Consequently, the code ultimately executed can differ from the content that existed when the Skill was audited.

HTTPS provides transport protection but does not mitigate compromise of the hosting infrastructure, publisher account, DNS configuration, release process, or remote installer itself. Piping the response directly into an interpreter also prevents meaningful review before execution. Although installing the required CLI supports the declared Imgix functionality, immediate execution of unverified remote content exceeds the minimum privilege necessary to document or invoke that functionality.

Attack Path

  1. An Imgix operation fails because the oo CLI is not installed.
  2. The agent or user follows the first-time setup instructions in SKILL.md.
  3. The command retrieves the current script from https://cli.oomol.com/install.sh or https://cli.oomol.com/install.ps1.
  4. The remote endpoint, publishing account, or delivery infrastructure has been compromised, or otherwise serves modified content.
  5. Bash or PowerShell executes the response immediately without integrity or authenticity verification.
  6. The modified installer runs arbitrary commands with the privileges of the invoking user.

Impact Assessment

Successful exploitation provides arbitrary code execution under the invoking ...[truncated 577 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash and irm | iex installation patterns.
  • Prefer a trusted platform package manager with a version-pinned package and publisher verification.
  • If a standalone installer is required, download a version-specific artifact without executing it automatically.
  • Publish and require verification of a pinned SHA-256 digest and, preferably, a cryptographic signature tied to a documented publisher key.
  • Store the downloaded artifact locally, verify its integrity and authenticity, and allow it to be reviewed before execution.
  • Execute installation with ordinary user privileges unless a specific, documented operation requires elevation.
  • Keep installation user-driven rather than allowing the agent to install software automatically.
  • Document the files, network endpoints, and configuration changes made by the installer so users can assess its required privileges.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into a shell, which creates a supply-chain and remote-code-execution risk. If the install endpoint, CDN, DNS, or TLS trust path is compromised, arbitrary code could run immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The phrase "Use this skill for ANY Imgix request" is very broad and lacks constraints or negative examples, which can cause the skill to match routine mentions of Imgix beyond intended invocation contexts. The description does not clarify boundaries for when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.