ClawHub
Back to skill

Security audit

Mailcheck

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Mailcheck lookups, but its setup tells users to execute a downloaded installer script directly in the shell without verification.

Review the installer path before installing. Prefer official, signed, version-pinned, or package-managed oo CLI installation instructions, and avoid running curl | bash or irm | iex unless you accept that the downloaded script will run with your user privileges. After setup, the skill appears limited to Mailcheck read-style connector actions, but those actions may send queried emails, domains, and account information through OOMOL/Mailcheck.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from an external server and execute them immediately with Bash or PowerShell. Neither command pins an installer version, validates a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded content before execution.

Although the scripts are hosted on an OOMOL-branded domain and installation is only suggested when the oo command is unavailable, the effective installer payload can change after this Skill has been reviewed. Compromise of the distribution server, DNS or TLS infrastructure, publishing credentials, or installer pipeline could therefore turn these commands into an arbitrary-code-execution mechanism.

Installing a required CLI is consistent with the Skill's declared functionality, but executing an unverified network response directly in a shell exceeds the minimum risk necessary to perform that installation.

Attack Path

  1. The user attempts to use the Skill on a system where the oo CLI is unavailable.
  2. The action fails with an oo: command not found error.
  3. The agent or user follows the documented first-time setup command.
  4. The shell retrieves the current installer from cli.oomol.com.
  5. Bash or PowerShell executes the response without integrity or authenticity verification beyond transport security.
  6. If the remote content or delivery infrastructure has been compromised, attacker-controlled commands run with the privileges of the invoking user.

Impact Assessment

A malicious installer would obtain arbitrary code exec ...[truncated 837 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation patterns.
  2. Prefer a trusted platform package manager or a version-pinned release artifact from the official repository.
  3. Download the installer or binary as a separate step rather than executing the network response immediately.
  4. Publish a cryptographic checksum and, preferably, a signed release manifest. Verify both before execution.
  5. Pin the expected installer or CLI version so its contents cannot change silently after review.
  6. Require explicit user approval before installing software or executing any downloaded installer.
  7. Run installation with ordinary user privileges unless elevated privileges are demonstrably required.
  8. Document the files, directories, network endpoints, and permission changes expected during installation.
  9. If script-based installation must remain available, show a safer workflow such as downloading to a local file, verifying its signature and checksum, allowing inspection, and only then executing it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into bash, which is a classic supply-chain and arbitrary code execution risk. If the remote host, transport chain, or install script is compromised, the user will execute attacker-controlled code immediately with their shell privileges.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says to use this skill for ANY Mailcheck request and instead of calling the API directly, which is an overly broad trigger that can cause the agent to invoke the skill in many contexts without sufficient specificity or user intent checks. In an agentic environment, broad auto-routing increases the chance of unnecessary external data access and execution of connector-backed actions when a narrower trigger or clearer scope would reduce exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.