ClawHub
Back to skill

Security audit

MoonClerk

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a coherent MoonClerk read connector, but its first-time setup tells users or agents to run unverified remote installer scripts directly in a shell.

Review the first-time setup before installing. Prefer installing the oo CLI through a verifiable package manager or a downloaded, inspected, signed release instead of piping remote scripts directly into bash or PowerShell. Also remember that using the connector can read MoonClerk customer and payment data from the connected account.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Installation Script Executed by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a shell script from an external URL and pipes it directly into Bash. The retrieved script is not included in the audited project, pinned to an immutable version, or validated with a cryptographic signature or checksum. Consequently, its effective behavior can change after the Skill has been reviewed.

HTTPS protects the connection in transit but does not establish that every future script served by the endpoint is safe. Compromise of the hosting infrastructure, release process, DNS/account controls, or the vendor itself could cause arbitrary commands to be delivered. Piping directly into Bash also prevents a normal inspection and verification step before execution.

Installing a CLI can be necessary for the declared MoonClerk connector functionality, but executing an unverified remote script is not the minimum privilege or safest installation method required to accomplish that task.

Attack Path

  1. The oo command is unavailable and the agent or user follows the documented first-time setup instructions.
  2. An attacker compromises the remote script endpoint or its publishing pipeline, or otherwise causes it to return a modified payload.
  3. curl retrieves the attacker-controlled shell script.
  4. The pipe sends the response directly to Bash without version, checksum, signature, or content verification.
  5. Bash executes the payload with the privileges of the invoking user.
  6. The payload can read or modify accessible files, steal locally available credentials, install additional software, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The a ...[truncated 483 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the pipe-to-shell installation command with a trusted package-manager installation or a pinned release artifact.
  • Download the installer without executing it, then verify a vendor-published cryptographic signature or checksum obtained through an independent trusted channel.
  • Pin the download to a specific immutable version rather than a mutable installation URL.
  • Allow the user to inspect the downloaded script before execution.
  • Require explicit user approval before installing software or executing an installer.
  • Run installation with ordinary user privileges and avoid sudo unless a specific, documented operation requires elevation.
  • Document the files, permissions, and network endpoints used by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote PowerShell Script Executed Through Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction uses Invoke-RestMethod (irm) to retrieve PowerShell source code from an external endpoint and passes the response directly to Invoke-Expression (iex). Invoke-Expression evaluates the downloaded text as code in the current PowerShell process.

The payload is not present in the audited package and is not pinned or authenticated using a cryptographic signature or published checksum. Its behavior can therefore be changed after review. Direct evaluation also bypasses an opportunity to save, inspect, and validate the installer before running it.

Installation of the required CLI may support the Skill's declared functionality, but unrestricted evaluation of mutable remote code grants more authority than is necessary for documenting or invoking the MoonClerk connector.

Attack Path

  1. The oo command is unavailable on a Windows system, prompting use of the first-time setup command.
  2. An attacker compromises the script host, publishing pipeline, or related delivery controls and replaces the installer response.
  3. Invoke-RestMethod downloads the modified PowerShell source.
  4. The pipeline supplies the response directly to Invoke-Expression, with no signature, checksum, version, or content validation.
  5. PowerShell executes the attacker-controlled commands using the current process token.
  6. The payload can access user data and credentials, download further components, modify account configuration, or create persistence. An elevated PowerShell session would expand the impact to administrative operations.

Impact Assessment

Exploitation results in arbitrary PowerShell execution with the invoking user's privileges. Potentially exposed reso ...[truncated 493 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex pattern.
  • Prefer a trusted Windows package manager or a signed installer from a pinned release.
  • Download the installer to a local file without executing it.
  • Verify an Authenticode signature and a vendor-published cryptographic hash before execution.
  • Require explicit user approval after presenting the installer source, version, publisher, and expected changes.
  • Execute from a non-administrative PowerShell session unless elevation is strictly required and separately approved.
  • Constrain installer behavior and document expected filesystem, registry, process, and network activity.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). That creates a supply-chain and remote code execution risk: if the install endpoint, network path, or hosting is compromised, arbitrary code will run on the user’s system without review.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The description uses very broad activation language: 'ANY MoonClerk request' and 'Whenever a task involves MoonClerk'. This can overlap with many unrelated or mixed-context tasks that merely mention MoonClerk, and it does not provide boundaries or exclusions for when the skill should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.