ClawHub
Back to skill

Security audit

IPGeolocation.io

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently connects to IPGeolocation.io through OOMOL, but its fallback setup tells an agent to run unverified remote installer scripts, so it should be reviewed before installation.

Install only if you trust OOMOL's CLI distribution path and are comfortable reviewing or replacing the remote installer steps with a safer manual, pinned, and verified installation process. Avoid letting an agent run the installer automatically, especially from an elevated shell.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 57
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a mutable remote response directly into bash. The downloaded content is neither version-pinned nor validated using a cryptographic checksum or digital signature. It is also not saved for inspection before execution.

Although installing the oo CLI supports the Skill's declared functionality, direct execution of unverified network content is not the least-risk installation method. The effective code can change after the Skill has been reviewed. Compromise of the vendor's hosting infrastructure, DNS, TLS termination, publishing account, or build pipeline could turn this command into an arbitrary-code-execution mechanism.

Attack Path

  1. The user or agent attempts to use the Skill on a system where oo is unavailable.
  2. The oo: command not found fallback directs it to run the documented pipeline.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is passed directly to bash without inspection or integrity verification.
  5. A compromised or malicious response executes with the privileges of the invoking user.
  6. The payload could access local data, modify files, steal credentials available to that account, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The accessible scope includes files, credentials, environment data, network resources, and processes available to that user. If the command is run by a privileged account or through privilege elevation, the impact could extend to system-wide compromise.

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Prefer a reviewed package distributed through a trusted platform package manager.
  • Pin the installer or package to an explicit version.
  • If a standalone script is required, download it to a local file first.
  • Verify a vendor signature and a separately distributed, version-specific cryptographic checksum before execution.
  • Allow the user to inspect the downloaded script.
  • Require explicit user approval before installing software; an agent should not install it automatically after an action failure.
  • Execute the installer with the minimum required privileges and avoid unnecessary use of sudo or privileged accounts.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows installation instruction retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and passes it directly to Invoke-Expression (iex). This causes the remote response to execute immediately without version pinning, signature validation, checksum verification, or prior inspection.

The instruction creates a remote code-execution channel whose payload can change independently of the reviewed Skill. Installation of the required CLI is functionally relevant, but immediate execution of unverified remote content exceeds the minimum security exposure necessary to perform that installation.

Attack Path

  1. The user or agent encounters a missing oo CLI on Windows.
  2. It follows the first-time setup instruction in SKILL.md.
  3. PowerShell downloads the current content of https://cli.oomol.com/install.ps1.
  4. The pipeline sends that content directly to Invoke-Expression.
  5. If the hosting infrastructure, publishing account, DNS path, or installer supply chain is compromised, attacker-controlled PowerShell executes under the current security context.
  6. The payload could read user data, obtain accessible credentials, modify the system, download additional payloads, or configure persistence.

Impact Assessment

Successful exploitation permits arbitrary PowerShell execution with the invoking process's privileges. Under a standard user account, it can compromise that user's files, secrets, and accessible services. If PowerShell is running elevated, the payload may obtain system-wide access, alter security controls, install services, or compromise other users.

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Distribute a versioned and digitally signed Windows installer or package through a trusted package manager.
  • Require validation of the Authenticode signature and a version-specific cryptographic checksum.
  • Download the installer to disk separately instead of executing the network response directly.
  • Present the source, publisher, version, and expected checksum to the user before installation.
  • Require explicit user approval before executing any installer.
  • Run installation with the least-privileged account that can complete the task.
  • Document a manual, auditable installation process and provide rollback or uninstall guidance.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This is dangerous because it executes unverified code from the network without integrity checking, pinning, or user review; if the hosting endpoint, TLS trust chain, or delivery path is compromised, arbitrary code could run on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Static analysis

No suspicious patterns detected.