ClawHub
Back to skill

Security audit

Interzoid

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Interzoid connector, but its first-time setup tells the agent or user to run unverified remote installer scripts directly in a shell.

Review the first-time setup carefully before installing. Prefer installing the oo CLI through a trusted, versioned package or by downloading and verifying the installer before execution; do not let an agent run the remote installer automatically. Once oo is already installed and connected, the Interzoid connector actions themselves appear scoped and read-oriented.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installer Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable script from an external server and immediately executes it with Bash. The script is not pinned to a specific version, downloaded for inspection, or validated using a cryptographic signature or checksum.

HTTPS protects the connection in transit but does not mitigate compromise of the hosting service, publishing account, DNS infrastructure, or installer distribution pipeline. It also does not prevent the hosted script from being modified after the Skill has been reviewed. Any returned content executes with the privileges of the user running the command.

Installing the required CLI is relevant to first-time setup, but piping an unverified remote response directly into a shell exceeds the minimum safe mechanism necessary to install that dependency.

Attack Path

  1. The oo CLI is unavailable, causing the user or agent to follow the first-time setup instructions.
  2. An attacker compromises the remote installer, its publishing account, or another part of the delivery infrastructure.
  3. curl retrieves the attacker-controlled response from the mutable URL.
  4. The shell pipeline passes the response directly to Bash without local inspection or integrity verification.
  5. Bash executes the payload with the invoking user's privileges.
  6. The payload can access resources available to that user and may download additional components, alter local files, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. This may expose local files, credentials accessible to that user, shell configuration, connector data, and othe ...[truncated 370 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation pipeline.
  • Prefer a trusted operating-system package manager or an official, version-pinned release package.
  • If a standalone installer is necessary, download it to a local file without executing it.
  • Pin the installer or release artifact to an explicit version.
  • Publish and verify a cryptographic signature from a separately distributed trusted signing key.
  • Publish a SHA-256 checksum through an integrity-protected channel and verify it before execution.
  • Allow the user to inspect the downloaded script before running it.
  • Run installation with the least-privileged account possible and avoid requesting elevation unless strictly required.
  • Do not let the agent install the CLI automatically; require explicit user approval for installation.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote Installer Executed Through PowerShell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell setup command retrieves a mutable script using Invoke-RestMethod (irm) and passes its response directly to Invoke-Expression (iex). Invoke-Expression interprets the remote response as PowerShell code without requiring it to be saved, reviewed, version-pinned, signed, or checked against a trusted digest.

This creates a remote code-execution channel whose effective payload can change after the Skill has been audited. HTTPS alone does not establish the trustworthiness or immutability of the code served by the remote endpoint. A compromise of the server or software delivery process could therefore convert the documented setup command into arbitrary code execution.

Attack Path

  1. The oo CLI is unavailable on a Windows system.
  2. The user or agent follows the documented first-time setup command.
  3. An attacker causes the installer endpoint to return modified PowerShell content, such as through hosting or publisher-account compromise.
  4. irm retrieves the modified response.
  5. The pipeline supplies the response directly to iex.
  6. PowerShell executes the attacker-controlled commands with the current process's privileges.

Impact Assessment

Exploitation allows arbitrary PowerShell command execution as the invoking user. The resulting code could read or modify user-accessible files, access available credentials or tokens, change PowerShell profiles, install additional software, communicate with external systems, or attempt persistence. Execution from an elevated PowerShell session would expose administrative resources.

No malicious PowerShell payload is embedded in the audited project. The risk arises ...[truncated 107 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pattern.
  • Prefer a signed, version-pinned installer distributed through a trusted Windows package manager.
  • Otherwise, download the installer to disk without executing it.
  • Require a valid Authenticode signature from an expected publisher and verify its certificate and status.
  • Publish and verify a version-specific SHA-256 checksum through a separate trusted channel.
  • Permit local inspection before execution and invoke the verified file directly rather than through Invoke-Expression.
  • Use a standard, non-administrative account unless installation demonstrably requires elevation.
  • Require explicit user approval before downloading or executing installation code.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk because the downloaded script is executed without prior verification, integrity checking, or user review; if the hosting endpoint or distribution path is compromised, arbitrary code could run on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Static analysis

No suspicious patterns detected.