ClawHub
Back to skill

Security audit

Marketstack

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Marketstack connector, but its fallback setup tells agents to run unverified remote installer scripts that can execute arbitrary local code.

Install only if you are comfortable with OOMOL's CLI and account connection model. Do not let an agent run the documented curl | bash or irm | iex fallback automatically; install the oo CLI through a verified manual process and review the installer source or signatures first.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Shell Script Execution via curl and Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and pipes it directly into Bash. The script is executed without version pinning, cryptographic signature verification, checksum validation, or an opportunity to inspect the downloaded content.

Consequently, the code ultimately executed can differ from the content reviewed during this audit. If the distribution server, publishing process, domain, or trusted TLS infrastructure is compromised, the endpoint can deliver arbitrary shell commands. The -f, -s, and -S options do not authenticate the script's contents or protect against supply-chain compromise.

This installation behavior is not required during normal Skill operation because the document states that the oo CLI should already be installed. It is only a fallback for a missing command. Moreover, arbitrary Bash execution exceeds the declared allowed-tools: [Bash(oo *)] least-privilege boundary, which otherwise limits the Skill to oo commands.

Attack Path

  1. The oo command is unavailable, or the user is induced to believe installation is necessary.
  2. The user follows the documented fallback installation command.
  3. The command retrieves the current response from https://cli.oomol.com/install.sh.
  4. An attacker who has compromised the hosting or publication path causes the endpoint to return malicious shell commands.
  5. Bash executes those commands immediately without integrity verification or review.
  6. The payload operates with the privileges and environmental access of the user who invoked the command.

Impact Assessment

A malicious installer could execute arbitrary commands with the invoking user's privileges. Potential effects inc ...[truncated 394 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the pipe-to-shell installation instruction.
  • Direct users to a version-pinned release hosted in a verified official repository.
  • Download the installer or binary to a local file without executing it automatically.
  • Publish and require verification of a cryptographic signature or a checksum obtained through a separately protected channel.
  • Allow the user to inspect the downloaded artifact before execution.
  • Require explicit user approval before installing software or executing commands outside the declared oo command boundary.
  • Prefer a trusted operating-system package manager with signed packages where available.
  • Keep installation outside the Skill's automated workflow; on a missing-CLI error, return a clear diagnostic and a link to reviewed manual installation documentation.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote PowerShell Script Execution via Invoke-RestMethod

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and passes the returned content directly to Invoke-Expression (iex). The remote content is therefore interpreted as PowerShell code without version pinning, signature enforcement, checksum verification, or prior inspection.

Because the effective payload is controlled by the external endpoint at execution time, it can change after the Skill has been reviewed. Compromise of the script publication pipeline, hosting account, domain, or trusted transport infrastructure could turn this instruction into an arbitrary-code-execution channel.

The Skill declares that the CLI should already be installed and limits its allowed tooling to Bash(oo *). Downloading and interpreting unrestricted PowerShell code is only a fallback installation mechanism and exceeds the minimum privileges needed for the declared Marketstack read functionality.

Attack Path

  1. The oo CLI is absent, or the user is directed to perform first-time setup.
  2. The user runs the documented PowerShell command.
  3. Invoke-RestMethod obtains the current content of https://cli.oomol.com/install.ps1.
  4. An attacker with control over the remote delivery or publication path substitutes malicious PowerShell content.
  5. Invoke-Expression immediately evaluates the response as code without integrity validation.
  6. The payload accesses or changes resources available to the PowerShell process and its user account.

Impact Assessment

A substituted script could run arbitrary PowerShell commands with the invoking user's privileges. It could access user files, credentials, tokens, environment variables, and network resources; modify l ...[truncated 248 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the irm ... | iex pattern with a non-executing, version-pinned download procedure.
  • Distribute a signed PowerShell script or signed binary and require signature validation before execution.
  • Publish a cryptographic checksum through a separately protected channel and verify it locally.
  • Save the artifact to disk for inspection instead of evaluating the HTTP response directly.
  • Require explicit user consent before executing an installer.
  • Prefer a trusted Windows package manager and signed package manifest where supported.
  • Keep software installation outside the automated Skill workflow and preserve the declared least-privilege boundary by limiting normal execution to approved oo commands.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to fetch and immediately execute a remote shell script via curl ... | bash. This is dangerous because it bypasses integrity verification and turns compromise of the hosting domain, TLS interception, or script changes into arbitrary code execution on the user's machine. In this skill context, the risk is heightened because the installation command is presented as an automated recovery step when oo is missing, making it plausible an agent could execute it without sufficient scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Static analysis

No suspicious patterns detected.