ClawHub
Back to skill

Security audit

Manatal

Security checks for vulnerabilities and agentic risk

Overview

This Manatal connector is mostly coherent, but its setup includes unverified remote installer commands and it can create or update recruiting data.

Review the installer path before installing. Prefer installing the oo CLI through a trusted, versioned, verifiable method, and only allow create or update actions after checking the exact Manatal records and payloads involved.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:70
Finding

Unverified Remote Installer Download and Immediate Shell Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70–74
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from an external server and pass their contents directly to command interpreters. Neither command pins an immutable release, verifies a cryptographic signature or digest, nor gives the user an opportunity to inspect the downloaded content before execution.

HTTPS protects the connection in transit but does not establish that the current server-side script is identical to the version reviewed with this Skill. Compromise of the hosting infrastructure, publishing process, domain, or trusted TLS path could substitute arbitrary commands. Those commands would execute with the permissions of the user or agent invoking the installer.

The Windows command has the same security properties as the Unix command: irm downloads the response, and iex immediately interprets it as PowerShell code.

This execution capability is broader than the Skill's declared need to invoke Manatal connector operations through an already installed CLI. Although the instructions present installation as a fallback after oo: command not found, arbitrary remote script execution exceeds the minimum privilege required for normal connector use.

Attack Path

  1. The agent or user attempts to use the Skill on a system where the oo CLI is unavailable.
  2. The documented fallback directs the agent or user to run the applicable installation command.
  3. The command retrieves the current installer from cli.oomol.com without checking an expected signature or digest.
  4. The hosting service, publishing pipeline, domain resolution, or ...[truncated 1027 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all instructions that pipe downloaded content directly into bash, iex, or another interpreter.
  • Prefer installation through a reputable platform package manager using a version-pinned package.
  • Direct users to a manual installation guide rather than allowing an agent to execute an installer automatically.
  • If a script-based installer is unavoidable:
    1. Pin an immutable, versioned release URL.
    2. Download the installer to a local file without executing it.
    3. Publish the expected SHA-256 digest through a separately protected release channel.
    4. Verify the digest and, preferably, a cryptographic signature before execution.
    5. Abort installation if verification fails.
    6. Permit inspection of the downloaded script before it is run.
    7. Execute with ordinary user privileges and request narrowly scoped elevation only when strictly necessary.
  • Keep normal Skill execution limited to the declared Bash(oo *) interface and require users or trusted administrators to install the CLI outside the Skill workflow.
  • Document the OOMOL intermediary and the categories of Manatal data transmitted through it so users can make an informed privacy and compliance decision.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill recommends installing software via a remote script piped directly into a shell, which executes unverified code from the network without an integrity check or manual review. If the distribution server, transport, or script source is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description instructs use of this skill for ANY Manatal request, creating an overly broad trigger scope with no constraints on operation type, data sensitivity, or safer alternatives. This increases the chance the skill is invoked in unintended contexts, including sensitive read/write operations, and amplifies downstream risks because the same skill can perform state-changing actions through the connector.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.