ClawHub
Back to skill

Security audit

Needle

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for operating Needle, but its first-time setup tells users to execute remote installer scripts directly, which is high-impact and not integrity-checked.

Review this skill before installing. The Needle connector behavior is disclosed and mostly scoped, but avoid running the shown one-line installer commands unless you trust the OOMOL installer source and are comfortable with a remote script executing on your machine. Prefer a signed, pinned, or manually verified oo CLI installation path if available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installation Scripts Executed Directly by Shell Interpreters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable content from cli.oomol.com and immediately execute it with Bash or PowerShell. Neither installation path pins a release version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded file before execution.

HTTPS provides transport protection but does not establish the integrity of the installer against compromise of the hosting origin, vendor account, CDN, or associated delivery infrastructure. It also cannot prevent a legitimate publisher from changing the effective payload after this Skill has been reviewed.

Although installation is only recommended after an oo: command not found error, the installation mechanism grants the downloaded script arbitrary code execution with the invoking user's privileges. This behavior also falls outside the Skill's declared allowed-tools: [Bash(oo *)] scope: the declared operational functionality requires invoking an existing oo executable, whereas installation invokes curl, bash, and equivalent PowerShell download and evaluation primitives.

Attack Path

  1. A user attempts a Needle operation, but the oo CLI is unavailable.
  2. The Skill directs the user or Agent to retrieve an installer from cli.oomol.com.
  3. An attacker compromises or gains control over the installer origin, publishing account, CDN, or another component of the remote delivery path.
  4. The attacker substitutes malicious shell or PowerShell instructions for the expected installer.
  5. curl | bash or irm | iex passes the resp ...[truncated 1076 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both pipe-to-interpreter installation commands.
  2. Direct users to a specific, version-pinned release from the vendor's verified release channel.
  3. Download the installer or binary to a local file without executing it automatically.
  4. Publish and verify a cryptographic signature using a trusted vendor signing key. If signatures are unavailable, verify a release-specific SHA-256 digest obtained through an independently authenticated channel.
  5. Fail closed when signature or digest verification fails.
  6. Allow the user to inspect the downloaded artifact and require explicit approval before execution.
  7. Prefer a signed operating-system package or package-manager distribution with version pinning and provenance verification.
  8. Keep CLI installation outside the Skill's operational workflow and its restricted Bash(oo *) permission boundary.
  9. Document the installer's expected filesystem changes, requested privileges, and supported rollback process.
  10. Do not request administrator or root privileges unless a specific installation step demonstrably requires them.

A safer high-level workflow is: download a pinned release, verify its signature or published digest, present the verified artifact and intended changes to the user, obtain approval, and only then execute or install it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill recommends curl ... | bash to install the CLI, which executes a remote script directly without verification. If the install endpoint, network path, or hosting account is compromised, an attacker could achieve arbitrary code execution on the user's machine under the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Needle request" and whenever a task involves Needle, without narrowing the contexts, trigger phrases, or exclusions. For a manifest/markdown skill description, this is an overly broad activation condition that could cause unintended invocation across a wide range of Needle-related requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.