ClawHub
Back to skill

Security audit

Lumos

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Lumos read connector, but its setup instructions include unverified remote installer commands that execute immediately.

Review the installation step before using this skill. Prefer installing the oo CLI through a verified, pinned, or signed method instead of running the documented curl-to-bash or irm-to-iex commands, and keep use focused on the listed Lumos read actions unless future versions add clearly tagged write actions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Shell Script Execution via curl and Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command pipes a mutable remote response directly into Bash. The payload is not included in the reviewed project and is executed without version pinning, checksum verification, publisher-signature validation, or prior inspection.

HTTPS protects the connection in transit but does not establish that every future script served by the endpoint is safe. Compromise of the remote hosting account, distribution infrastructure, or publisher could cause this command to execute attacker-controlled shell code. This installation mechanism is not required to perform the Skill's declared read-only Lumos operations and exceeds the least-privilege requirements of those operations.

Attack Path

  1. The oo CLI is unavailable, causing the user or agent to follow the first-time installation instructions.
  2. The remote installer endpoint or its supporting distribution infrastructure is compromised, or the hosted script is changed unexpectedly.
  3. The command downloads the modified response.
  4. The shell pipe sends the response directly to Bash without verification.
  5. The payload executes with the permissions of the user running the command.
  6. The payload can subsequently modify files, access data available to that user, install additional software, or establish persistence.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's privileges. Depending on that user's permissions and environment, the payload could access local files and credentials, modify user configuration, install persistent components, or retrieve additional payloads. If invoked from a privileged shell, the impact ...[truncated 39 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation instruction.
  • Prefer an official operating-system package manager with a pinned package version and authenticated repository metadata.
  • If a standalone installer is unavoidable, download a versioned artifact to disk without executing it immediately.
  • Publish and require verification of a pinned SHA-256 digest and, preferably, a cryptographic signature from a documented publisher key.
  • Allow the installer to be inspected before execution and use a fixed release URL rather than a mutable generic installer URL.
  • Keep CLI installation outside automated Skill execution and require explicit user approval before running any installer.
  • Run installation with ordinary user privileges unless a documented installation step strictly requires elevated access.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote PowerShell Script Execution via Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Code Snippet:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

irm retrieves mutable content from an external URL and passes it directly to iex (Invoke-Expression). This causes the downloaded text to execute as PowerShell code without local review, version pinning, integrity verification, or publisher-signature validation.

The effective payload can change after the Skill has been audited. A compromise or unauthorized modification of the remote installer could therefore convert this documented setup command into an arbitrary code-execution channel. Installing software in this manner grants substantially broader local capabilities than are necessary for the Skill's declared read-only Lumos connector actions.

Attack Path

  1. The oo CLI is unavailable on a Windows system.
  2. The user or agent follows the documented PowerShell installation instruction.
  3. The installer endpoint or distribution infrastructure serves malicious or unexpectedly modified PowerShell content.
  4. Invoke-RestMethod downloads that content into the pipeline.
  5. Invoke-Expression executes it immediately without integrity or authenticity checks.
  6. The payload performs arbitrary actions permitted by the current PowerShell security context.

Impact Assessment

Successful exploitation allows arbitrary PowerShell execution with the invoking user's privileges. The payload could read accessible files, collect credentials or tokens available to the current user, alter PowerShell profiles, install additional components, or create persistence. Execution from an elevated PowerShell session could result in system-wide modification or compromise.

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Prefer a signed package distributed through a trusted Windows package manager with a pinned version.
  • If direct distribution is necessary, download a versioned installer separately and verify its Authenticode signature and a publisher-provided pinned SHA-256 digest before execution.
  • Do not use Invoke-Expression for remotely retrieved content.
  • Display the verified installer path and require explicit user approval before execution.
  • Document the expected publisher identity and fail closed if signature or digest verification fails.
  • Avoid administrative execution unless a specific, documented installation operation requires elevation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). If the remote server, CDN, DNS, TLS trust chain, or install script is compromised, this yields immediate arbitrary code execution on the host running the skill. The surrounding context makes this more dangerous because the instructions are embedded as an operational fallback inside the skill, increasing the chance an automated agent executes them during error recovery without independent verification.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Lumos request" and "Whenever a task involves Lumos," which is extremely broad and lacks boundaries or exclusion conditions. This can overlap with ordinary references to Lumos-related work and does not specify when the skill should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.