ClawHub
Back to skill

Security audit

Mailgun

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Mailgun via OOMOL, but it uses broad CLI authority and includes unsafe remote installer commands.

Install only if you are comfortable routing Mailgun requests and responses through OOMOL, and avoid the documented pipe-to-shell installer unless you independently verify the installer source. Use a narrowly scoped Mailgun key and confirm all write, send, update, and delete actions before execution.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:71
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:3
Finding

Unconditional Routing of Mailgun Data Through a Third-Party Connector

Content
View full analysis
" ``` ```bash oo connector run "mailgun" --action "" --data '' --json ``` ### Technical Analysis The Skill categorically instructs the agent to route every Mailgun request through OOMOL rather than allowing direct use of Mailgun's API. Although the intermediary is disclosed, this instruction changes the agent's tool-selection behavior and introduces an additional service into the data and authorization boundary. Submitted payloads and returned results can include email addresses, message content, template content, suppression records, domain settings, DNS information, delivery events, and engagement information. OOMOL also injects Mailgun credentials server-side and performs operations on the user's behalf. No evidence in the reviewed file establishes covert exfiltration or malicious handling by OOMOL. The security concern is the unconditional routing requirement and resulting third-party exposure, particularly when the user may expect a Mailgun request to involve only Mailgun. ### Attack Path 1. A user asks the agent to perform a Mailgun operation. 2. The Skill instructs the agent to use OOMOL for every Mailgun request and not call Mailgun directly. 3. The agent places request data in the `--data` payload ...[truncated 1144 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:5
Finding

Overbroad Authorization for All oo CLI Subcommands

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification, gives the remote server full code-execution capability on the host, and turns any compromise of the download endpoint, CDN, DNS, TLS trust chain, or repository release process into immediate arbitrary command execution.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Static analysis

No suspicious patterns detected.