ClawHub
Back to skill

Security audit

Mails

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Mails email-validation workflows, but its setup instructions include unverified remote scripts executed directly in a shell.

Review the setup path before installing. Prefer a verified package manager or a downloaded installer with a published checksum/signature instead of piping remote scripts into bash or PowerShell. Once oo is already installed and connected, the listed connector actions are narrow, but confirm any batch creation payload before it runs.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Remote Shell Script Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 57
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a remotely retrieved shell script directly into Bash. The payload is mutable and is not pinned to a reviewed release, downloaded for inspection, or validated using a cryptographic signature or trusted checksum.

Although the endpoint belongs to the service named by the Skill and this command is presented as a conditional first-time setup step, the practice makes the current contents of the remote endpoint equivalent to trusted local code. The security of the local system therefore depends on the continued integrity of the remote server, its deployment pipeline, DNS resolution, and TLS infrastructure. A future change or compromise can alter the effective payload after the Skill itself has been reviewed.

This installation mechanism exceeds the minimum privileges required for the Skill's normal functionality. Email validation only requires invoking an already installed oo CLI; arbitrary remote shell execution is not required to inspect schemas or invoke the mails_so connector.

Attack Path

  1. An attacker compromises the installation endpoint, its publishing credentials, hosting pipeline, or another component capable of controlling the returned script.
  2. The oo command is unavailable on the user's macOS or Linux system.
  3. The user or Agent follows the documented first-time setup instruction.
  4. curl retrieves the attacker-controlled response.
  5. The pipe sends the response directly to Bash without prior inspection or integrity verification.
  6. Bash executes the payload with the privileges of the invoking account.

Impact Assessment

Successful exploitation provides arbitrary command execution under the i ...[truncated 502 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell.
  • Prefer installation through a signed operating-system package or another trusted package manager.
  • Pin installation instructions to a specific, immutable CLI release rather than a mutable endpoint.
  • Download the artifact without executing it, then verify a vendor-provided cryptographic signature or a SHA-256 checksum obtained through a separately authenticated channel.
  • Provide users an opportunity to inspect the downloaded script or package before execution.
  • Run installation with ordinary user privileges unless a documented component strictly requires elevation.
  • Keep setup outside routine Skill execution and require explicit user approval before installing software.
  • Document the expected files, network destinations, and permission changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Remote PowerShell Script Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows installation instruction retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and passes its contents directly to Invoke-Expression (iex). Invoke-Expression interprets the network response as PowerShell code immediately. No version pinning, signature validation, checksum verification, local review, or content restriction occurs before execution.

The endpoint is associated with the named OOMOL service and the instruction is conditional on the CLI being absent, but these factors do not establish the integrity of the script at execution time. Compromise or unauthorized modification of the endpoint can introduce code that was not present during the Skill audit.

This behavior exceeds the least privilege needed for the declared email-validation functionality. Normal operation needs only the constrained oo connector commands allowed by the Skill; it does not inherently require arbitrary remote PowerShell execution.

Attack Path

  1. An attacker gains control over the PowerShell installation response through compromise of the hosting account, publishing pipeline, server, or related delivery infrastructure.
  2. The oo CLI is missing on a Windows system.
  3. The user or Agent follows the first-time setup documentation.
  4. irm downloads the modified PowerShell source.
  5. The pipeline supplies the unverified response to iex.
  6. PowerShell executes the attacker-controlled instructions with the invoking account's permissions.

Impact Assessment

Exploitation permits arbitrary PowerShell execution as the current user. An attacker could access user-readable files, collect credentials or tokens, modify account ...[truncated 405 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex installation pattern.
  • Distribute a versioned and Authenticode-signed PowerShell script or signed installer package.
  • Download the installer to a local file, verify its signer and cryptographic hash, and abort if verification fails.
  • Pin the documentation to an immutable release and publish checksums through a separately authenticated release channel.
  • Prefer Windows Package Manager or another repository that verifies signed, versioned packages.
  • Require explicit user approval before software installation and avoid elevation unless it is strictly necessary and documented.
  • Document the installer's expected filesystem, registry, process, and network effects.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software via a remote script piped directly into a shell (curl ... | bash). This pattern is dangerous because it executes network-fetched code without prior verification, allowing supply-chain compromise, MITM-related abuse in weaker environments, or accidental execution of a malicious/changed installer with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation guidance is overly broad: 'Use this skill for ANY Mails request' can cause an agent to route all Mails-related tasks through this skill without checking whether the requested operation is appropriate, necessary, or safe. In an agentic environment, broad triggering increases the chance of unintended data access or write operations, especially when combined with a tool that can directly execute connector actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.