ClawHub
Back to skill

Security audit

Investoday MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Investoday data connector, but its first-time setup tells the agent to run an unverified remote installer script directly in the shell.

Review the installer source before using this skill. Prefer installing the oo CLI through a trusted, pinned package or verified release, and only connect the Investoday account/API key after confirming the connector and billing implications are acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
95% confidence
Finding
The skill instructs the agent to install software by piping a remotely fetched script directly into `bash`, which is a classic supply-chain risk. If the remote host, network path, or installation script is compromised, arbitrary code will execute immediately on the user's machine with the agent's privileges.

Static analysis

No suspicious patterns detected.