ClawHub
Back to skill

Security audit

Microsoft Text Translate

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned for Microsoft Text Translate, but its setup instructions tell users to run unverified remote installer scripts directly in a shell.

Review this skill before installing. Use it only when you are comfortable sending the relevant text through OOMOL/Microsoft Text Translate, and avoid running the documented remote installer commands directly unless you independently trust and verify the oo CLI installer source.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The first-time setup instructions execute remotely hosted installation scripts directly in a local shell:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands combine remote content retrieval with immediate execution. The downloaded scripts are mutable and are not pinned to a specific release, inspected before execution, or validated using a cryptographic checksum or digital signature.

Although the scripts are hosted on a domain associated with the declared OOMOL service, the repository contents do not establish the integrity or future trustworthiness of the remote payload. A compromise of the hosting account, deployment pipeline, domain, DNS resolution, or TLS termination infrastructure could change the executed code after this Skill has been reviewed.

Installing the CLI may be necessary for the Skill's declared functionality, but executing an unverified remote script is not the minimum-privilege installation method. The script receives all permissions of the user running the shell and is not shown to be sandboxed or otherwise constrained.

The Skill also sends translation payloads to the OOMOL connector. That transmission is disclosed and functionally consistent with its cloud translation purpose; the reviewed file does not demonstrate unrelated data exfiltration or credential harvesting.

Attack Path

  1. An attacker compromises the remote installer hosting environment, publication pipeline, domain infrastructure, or another component capable of modifying the installer response.
  2. The attacker replaces either install.sh or install.ps1 with a malicious payload.
  3. A user encounters the docu ...[truncated 940 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation patterns.
  2. Prefer a trusted platform package manager or a version-pinned release artifact from the official project repository.
  3. Download the installer to a local file without executing it automatically.
  4. Publish SHA-256 checksums and, preferably, cryptographic signatures through an independently protected release channel.
  5. Verify the checksum and signature before execution, and fail closed if validation does not succeed.
  6. Give the user an opportunity to inspect the downloaded installer and require explicit approval before running it.
  7. Pin documentation to an immutable CLI version rather than a mutable generic installer URL.
  8. Run installation with ordinary user privileges unless a narrowly defined operation genuinely requires elevation.
  9. Document the files, environment changes, network endpoints, and permissions used by the installer.
  10. Where practical, advise users to install the CLI independently rather than allowing an Agent to retrieve and execute installation code.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install the CLI via a 'curl | bash' pattern, which executes a remote script directly from the network without prior verification. If the hosting domain, transport path, or script supply chain is compromised, arbitrary code could run on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes the skill as suitable for 'searching and reading data,' but the actual actions perform text analysis and transformation against a third-party service. This misleading description can cause an agent to invoke the skill in overly broad contexts and send user text to an external connector when that was not the appropriate or least-privileged choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction to use this skill for 'ANY Microsoft Text Translate request' is an overly broad trigger that encourages automatic invocation whenever translation-related work appears, without first assessing whether the action is necessary, privacy-appropriate, or the best available option. Broad routing rules increase the chance of unnecessary external data exposure and reduce opportunity for contextual safety checks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Labeling untagged actions as 'reads' is inaccurate because these operations process and transform user-provided content through an external service rather than merely retrieving stored data. That misclassification can weaken safety checks, leading agents or users to treat data-transmitting operations as inherently safe and run them without appropriate scrutiny for privacy or consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.