ClawHub
Back to skill

Security audit

Leexi

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Leexi read-only connector, but its first-time setup tells users or agents to run unverified remote installer scripts directly in a shell.

Before installing, treat the Leexi read actions as normal connector use, but do not run the documented remote installer commands blindly. Install the oo CLI only from a source you trust, prefer a verified or package-manager installation path, and keep OOMOL/Leexi account connection steps under explicit user control.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Bash Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The instruction downloads a mutable installation script from an external server and pipes it directly into Bash. The package does not pin an installer version, verify a cryptographic signature or checksum, or allow inspection of the downloaded content before execution.

Although HTTPS protects the connection in transit under normal conditions, it does not guarantee that the remote script remains identical to the version assessed during this audit. Compromise of the distribution server, hosting account, domain, DNS path, or release process could cause arbitrary attacker-controlled commands to be returned and immediately executed.

Installing the CLI may be relevant when it is absent, but direct pipe-to-shell execution exceeds the minimum privileges and trust required to provide installation guidance.

Attack Path

  1. The oo CLI is unavailable, or a failure is presented as an "oo: command not found" condition.
  2. The user or agent follows the documented first-time setup instruction.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without integrity or content verification.
  5. If the remote distribution path has been compromised, attacker-controlled shell commands execute with the privileges of the invoking user.
  6. Those commands can access data available to that user and may establish additional compromise outside the audited Skill.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. This may permit theft of locally accessible credentials and files, modification or deletion of user data, installation of malicious programs ...[truncated 159 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation command.
  • Direct users to a pinned, authenticated release from the official distribution channel.
  • Download the installer or binary to disk as a separate operation before execution.
  • Publish and verify a SHA-256 checksum or, preferably, a cryptographic signature whose verification key is distributed through an independent trusted channel.
  • Display the resolved version, source URL, and verification result before execution.
  • Require explicit user approval before running any installer.
  • Run installation with ordinary user privileges unless a documented operation strictly requires elevation.
  • Prefer a trusted platform package manager where package provenance and update controls are available.

A safer conceptual flow is: download a pinned artifact, verify its signature or checksum, inspect it where applicable, and only then execute it after user confirmation.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote PowerShell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Remote payload retrieval and immediate PowerShell execution
Risk Level: Critical

Vulnerable Code

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The instruction retrieves a mutable PowerShell script from an external URL using Invoke-RestMethod (irm) and immediately evaluates the response using Invoke-Expression (iex). No release version is pinned, and no Authenticode signature, detached signature, or cryptographic checksum is verified before execution.

Invoke-Expression treats the downloaded response as executable PowerShell code. Consequently, the effective payload can change after the Skill has been reviewed. HTTPS alone does not protect against compromise of the legitimate server, publishing account, domain, or software release process.

Providing installation guidance is relevant to first-time setup, but evaluating an unverified network response is not necessary for the Skill's declared read-only Leexi functionality and violates least-trust installation practices.

Attack Path

  1. The oo CLI is unavailable, or a failure is interpreted as requiring installation.
  2. The user or agent runs the documented PowerShell setup command.
  3. Invoke-RestMethod retrieves the current contents of https://cli.oomol.com/install.ps1.
  4. The retrieved text is piped directly into Invoke-Expression.
  5. If the remote distribution path is compromised, attacker-supplied PowerShell executes without an integrity check or review.
  6. The payload can act with the invoking PowerShell process's privileges and access locally available resources.

Impact Assessment

Successful exploitation permits arbitrary PowerShell execution under the invoking user's security context. Potential consequences include credential and file theft, local data alteration, malicious software installation, and compromise o ...[truncated 176 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex pattern.
  • Link to a pinned official release rather than executing the current contents of a mutable installer URL.
  • Save the installer to disk before execution.
  • Require a valid Authenticode or detached cryptographic signature from an expected publisher; alternatively, verify a securely published SHA-256 checksum.
  • Present the artifact version, publisher identity, source, and verification outcome to the user.
  • Require explicit user authorization before executing the verified installer.
  • Avoid administrative execution unless installation genuinely requires it and the requested elevation is clearly explained.
  • Prefer a trusted Windows package-management channel with publisher and package-integrity validation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via a remote script piped directly into a shell, which executes unverified code fetched at runtime. If the install endpoint, CDN, TLS trust chain, or upstream distribution is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Leexi request" and "Whenever a task involves Leexi," which is an extremely broad activation condition. It does not define boundaries, exclusions, or negative examples, so ordinary mentions of Leexi could trigger the skill unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.