ClawHub
Back to skill

Security audit

Mailjet

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Mailjet connector, but its setup instructions include unverified remote installer commands that could execute arbitrary code if followed automatically.

Review the installer instructions before installing. The Mailjet actions themselves are narrowly described and include confirmation for writes, but users should install the oo CLI through a safer reviewed channel or manually verify the installer before executing it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions download mutable scripts from cli.oomol.com and immediately execute their contents using Bash or PowerShell. Neither installation path pins a release version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded payload before execution.

HTTPS protects the connection in transit under normal conditions, but it does not establish that the remotely hosted script is immutable or safe. The effective code can change after the Skill has been reviewed. Compromise of the hosting infrastructure, domain, DNS resolution, TLS issuance path, deployment credentials, or installer publishing pipeline could therefore turn these commands into an arbitrary-code execution channel.

Installing the oo CLI supports the declared Mailjet integration, but piping a download directly into a shell is not the minimum privilege or minimum-risk method necessary to perform that installation.

Attack Path

  1. The oo CLI is unavailable, causing the user or agent to follow the first-time setup instructions.
  2. An attacker compromises or gains control over the remote installer delivery path, such as the hosting account, publishing pipeline, domain, DNS, or TLS infrastructure.
  3. The attacker replaces the installer response with malicious shell or PowerShell commands.
  4. The documented curl | bash or irm | iex pipeline retrieves the modified content.
  5. The local shell executes the content immediately without integrity verification or review.
  6. The payload performs arbitrary actions permitted b ...[truncated 834 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both direct download-to-shell pipelines.
  2. Publish versioned, immutable CLI releases through an official release repository or trusted package manager.
  3. Pin the installation instructions to a specific reviewed release rather than a mutable installer endpoint.
  4. Download the installer or binary to a local file without executing it automatically.
  5. Verify a publisher-provided cryptographic signature. If signatures are unavailable, verify a SHA-256 digest obtained through a separately protected and version-specific channel.
  6. Display the source URL, selected version, destination, and expected changes before installation, and require explicit user approval.
  7. Execute only after successful verification, using the least-privileged account required.
  8. Avoid automatic privilege elevation. If administrative access is genuinely required, explain why and request it separately.
  9. Document secure manual installation and removal procedures so users can inspect and reverse the installation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This is dangerous because it executes unpinned, unauthenticated remote code with no integrity verification, so a compromised host, CDN, DNS path, or upstream script change could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Static analysis

No suspicious patterns detected.