ClawHub
Back to skill

Security audit

Langbase

Security checks for vulnerabilities and agentic risk

Overview

The Langbase connector is mostly coherent, but its setup instructions include commands that directly execute downloaded installer scripts.

Review before installing. The Langbase actions themselves are clearly described and destructive operations require confirmation, but install the oo CLI only through a source you trust and prefer verified or manually reviewed installation steps over direct curl | bash or irm | iex commands.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Shell Script Execution via Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command pipes a network response directly into Bash. The effective executable code is hosted outside the audited project and can change after the Skill has been reviewed. No fixed release version, cryptographic checksum, digital signature, or local review step is required before execution.

HTTPS protects the connection in transit but does not guarantee that the hosted script is safe or immutable. If the hosting account, web server, DNS resolution, certificate infrastructure, or release process is compromised, the returned content can contain arbitrary shell commands.

This behavior is not required for the Skill's normal connector operations because the document already assumes that the oo CLI is installed. It appears only as a fallback installation mechanism and exceeds the privileges needed merely to explain how to install a dependency safely.

Attack Path

  1. A user or agent attempts to run the Skill and receives an oo: command not found error.
  2. The agent follows the first-time setup instruction in SKILL.md.
  3. curl retrieves the current content of https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without being saved, inspected, pinned, or cryptographically verified.
  5. If an attacker controls or modifies the remote response, attacker-supplied shell commands execute with the privileges of the invoking user.
  6. Those commands can access user-readable data, modify files, install additional software, alter shell configuration, or establish persistence where the user's permissions permit.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking us ...[truncated 486 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Direct users to a signed package distributed through a trusted platform package manager where possible.
  • Pin installation instructions to a specific CLI release rather than a mutable installer endpoint.
  • If a standalone installer is unavoidable, download it to a local file without executing it automatically.
  • Publish and verify a cryptographic checksum and preferably a digital signature using a key distributed through an independent trusted channel.
  • Require users to inspect or explicitly approve the verified installer before execution.
  • Run installation with ordinary user privileges and request elevation only for narrowly defined operations that genuinely require it.
  • Keep installation outside the Skill's automated action path; the Skill should report that the dependency is missing and provide a verified installation reference rather than execute remote content.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote PowerShell Script Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The command uses Invoke-RestMethod (irm) to retrieve a mutable remote PowerShell script and passes the resulting content directly to Invoke-Expression (iex). Invoke-Expression interprets the downloaded text as PowerShell code without local inspection or integrity verification.

The project does not pin the installer to a reviewed release or provide a checksum or signature verification procedure. Consequently, the commands ultimately executed can differ from those present when the Skill was audited. Compromise of the remote host, publication pipeline, DNS/TLS dependencies, or associated administrative credentials could turn the documented installation step into an arbitrary-code-execution channel.

This direct execution method grants the downloaded content all permissions available to the PowerShell process and is broader than necessary to provide dependency installation guidance.

Attack Path

  1. A Windows user or agent discovers that the oo CLI is unavailable.
  2. The first-time setup instructions cause the PowerShell command in SKILL.md to be run.
  3. Invoke-RestMethod downloads the current response from https://cli.oomol.com/install.ps1.
  4. The response is supplied directly to Invoke-Expression, with no version pinning, signature validation, checksum comparison, or review.
  5. A compromised remote response executes as PowerShell code under the current process identity.
  6. The payload can read or modify resources available to that identity and can invoke other operating-system facilities within the user's permission boundary.

Impact Assessment

Exploitation results in arbitrary PowerShell execution with the invok ...[truncated 466 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pattern and never pass downloaded text directly to Invoke-Expression.
  • Prefer a signed and version-pinned package from a trusted Windows package repository.
  • If direct download is necessary, save a specific release artifact to disk first.
  • Validate its Authenticode signature and a separately published cryptographic digest before execution.
  • Reject unsigned artifacts, invalid signatures, unexpected publishers, redirects to unapproved hosts, and checksum mismatches.
  • Present the verified command or artifact to the user for explicit approval before running it.
  • Execute with standard-user permissions unless a documented installation operation specifically requires elevation.
  • Separate dependency installation from normal Skill execution so authentication or connector errors cannot lead to automatic remote-code execution.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). If the hosting domain, network path, or install script is compromised, this yields immediate arbitrary code execution on the user's machine under the current user context.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Langbase request" and "Whenever a task involves Langbase," which is an extremely broad activation condition. It does not provide trigger boundaries, exclusions, or negative examples, so ordinary references to Langbase could unintentionally invoke the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.