ClawHub
Back to skill

Security audit

IP2WHOIS

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only IP2WHOIS connector, with a setup command users should review before running.

Install only if you are comfortable using OOMOL as the broker for your IP2WHOIS API key. Do not let an agent blindly run the curl-to-bash or PowerShell installer; prefer reviewing the official oo CLI install path and connecting IP2WHOIS only with the intended account.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger text is overly broad: "Use this skill for ANY IP2WHOIS request" can cause the agent to invoke this skill for loosely related tasks without sufficient narrowing or user confirmation. In practice this increases the chance of unintended tool use and can route workflows into shell execution paths unnecessarily, which expands attack surface even though the listed actions are read-only.

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
98% confidence
Finding
The skill instructs the agent/user to install software via `curl ... | bash`, which executes remote code directly from the network without verification. If the distribution server, network path, or referenced script is compromised, this becomes arbitrary code execution on the host running the command.

Static analysis

No suspicious patterns detected.