ClawHub
Back to skill

Security audit

LinkedIn

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent LinkedIn connector, but its setup instructions include unverified remote installer commands and it can perform public account-changing actions.

Review the installation path before using this skill. Prefer installing the oo CLI from a pinned, verified release or package manager, and only allow LinkedIn write or delete actions after checking the exact payload and target post/account.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions download mutable scripts from an external server and immediately pass their contents to command interpreters. Neither installation path pins a specific release, verifies a cryptographic signature or checksum, nor saves the script for inspection before execution.

The installer source is presented as the CLI vendor's HTTPS domain, and installing the CLI supports the Skill's declared LinkedIn integration. However, HTTPS alone does not establish the integrity of future installer content. The commands create a remote code-execution channel whose effective payload can change after the Skill has been reviewed.

This execution mechanism exceeds the minimum privileges necessary to perform LinkedIn connector operations. The connector only requires an installed CLI; it does not inherently require executing unverified, mutable remote content. The downloaded installer runs with all privileges available to the invoking shell.

Attack Path

  1. A LinkedIn action fails because the oo CLI is not installed.
  2. The Agent or user follows the documented first-time setup instructions.
  3. The shell downloads the current response from cli.oomol.com.
  4. A compromise of the hosting account, release process, domain, or delivered installer causes malicious content to be returned.
  5. The pipe sends that content directly to Bash or PowerShell without integrity verification or prior review.
  6. The malicious script executes with the invoking user's permissions and can perform arbitrary local actions.

Impact Assessment

...[truncated 732 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation patterns.
  2. Pin installation instructions to a specific, immutable CLI version from the vendor's official release repository.
  3. Download the installer or package to a local file rather than piping it directly into an interpreter.
  4. Verify the downloaded artifact against a securely published SHA-256 or stronger checksum.
  5. Prefer cryptographic signature verification using a trusted, independently distributed signing key.
  6. Present the verified script or package to the user and require explicit approval before execution.
  7. Prefer a trusted operating-system package manager with version pinning and package-signature validation where available.
  8. Run installation with ordinary user privileges unless a narrowly scoped operation explicitly requires elevation.
  9. Document the files, commands, network destinations, and privilege changes performed by the installer.

A safer workflow is: download a pinned release, verify its checksum and signature, inspect or approve the artifact, and only then execute the local verified file.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs use of a remote install script piped directly into a shell (curl ... | bash), which executes unverified code from the network without integrity checking or review. If the remote server, distribution path, or connection is compromised, this can lead to arbitrary code execution on the host running the skill.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description says to use this skill for ANY LinkedIn request, including reading, creating, updating, and deleting data, without narrowing invocation to specific user intent or risk level. That broad trigger surface can cause the agent to select a high-privilege skill in situations where a narrower or read-only path would be safer, increasing the chance of unintended state-changing actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.