ClawHub
Back to skill

Security audit

LINE

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing LINE through OOMOL, but its setup instructions ask users to execute remote installer scripts directly without verification.

Review the setup path before installing. Prefer installing the oo CLI from a versioned, trusted release with checksum or signature verification, and confirm any LINE broadcast, multicast, or push-message payload before allowing it to run.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Remote Bash Installer Retrieved and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:59
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The setup instructions stream a remotely hosted installation script directly into Bash. The remote payload is not pinned to a specific version and is not authenticated through a cryptographic signature or verified against a trusted checksum. Although HTTPS protects the transport channel, it does not ensure that the script remains unchanged after the Skill has been audited.

Installing the required CLI may be necessary when it is absent, but directly executing mutable remote content exceeds the minimum privileges and trust necessary for installation. A compromise of the domain, CDN, hosting account, DNS infrastructure, or release pipeline could cause arbitrary attacker-controlled commands to execute locally.

Attack Path

  1. A LINE operation fails because the oo CLI is unavailable.
  2. The user or agent follows the first-time setup instructions.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without inspection or integrity verification.
  5. If the remote source or delivery infrastructure is compromised, attacker-controlled shell commands execute with the invoking user's privileges.
  6. Those commands can access local data, modify the user's environment, install additional payloads, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user running the installation command. The accessible scope may include the user's files, environment variables, authentication material, application configuration, and writable executables or startup configuration. Additional impact depends on the invoking accou ...[truncated 110 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Pin the CLI to a specific, audited release.
  • Download the installer or binary as a separate step from a versioned official release URL.
  • Verify a publisher signature or a trusted, pinned SHA-256 checksum before execution.
  • Prefer a reputable package manager with explicit version controls where available.
  • Display the installation action and require explicit user approval before executing downloaded code.
  • Run installation with standard user privileges unless elevated privileges are strictly required and separately approved.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Remote PowerShell Installer Retrieved and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup instruction retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and immediately executes its response through Invoke-Expression (iex). No version pinning, code-signature validation, checksum verification, or local review occurs before execution.

Invoke-Expression treats the entire remote response as trusted PowerShell code. Therefore, control of the remote script or its delivery infrastructure is equivalent to a local code-execution capability. HTTPS alone does not address changes made at the legitimate origin or compromise of the publisher's hosting and release systems.

Attack Path

  1. A LINE operation fails because the oo CLI is not installed on Windows.
  2. The user or agent follows the documented PowerShell setup command.
  3. irm downloads the current contents of https://cli.oomol.com/install.ps1.
  4. The pipeline sends the unverified response directly to iex.
  5. A malicious or compromised response executes as PowerShell under the current user.
  6. The payload can read accessible data, modify local configuration, install further software, or create persistence within the user's permission boundary.

Impact Assessment

Successful exploitation allows arbitrary PowerShell execution with the invoking user's privileges. Potentially exposed assets include user documents, environment variables, cached credentials accessible to that account, application settings, and writable startup locations. If PowerShell is running in an elevated administrative session, the payload may obtain system-wide modification capabilities.

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Publish and reference a versioned, immutable installer artifact.
  • Require Authenticode signature validation or verification of a trusted, pinned cryptographic checksum before execution.
  • Download the script to a local file so it can be inspected and validated before it is run.
  • Prefer a trusted Windows package manager with explicit package and version constraints.
  • Require explicit user approval before installing the CLI.
  • Avoid administrative execution unless installation genuinely requires it and the user has separately authorized elevation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install the CLI via a curl-piped-to-bash command, which executes remote code immediately without integrity verification, version pinning, or independent review. Because the skill is expressly designed to be used operationally and the install step is framed as remediation when the command is missing, a compromised distribution endpoint or MITM in a weak environment could result in arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description says to use this skill for ANY LINE request and instead of calling the API directly, which can cause an agent to invoke it for a very broad class of tasks without sufficient narrowing or least-privilege routing. In this skill, that broad trigger is more dangerous because the same skill exposes both read and write messaging actions, so an unintended invocation could lead to unreviewed outbound messages or unnecessary access to connected account data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.