ClawHub
Back to skill

Security audit

NetEase Mail

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing NetEase Mail, but its setup instructions include unsafe remote installer commands that execute downloaded code directly.

Review the oo CLI installation path before using this skill. Prefer a verified package, pinned release, checksum, or inspected installer instead of running the provided curl-to-bash or irm-to-iex commands. Also remember that once connected, the skill can read mailbox content and send, move, mark, or delete mail, so write and delete actions should be confirmed carefully.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:66
Finding
Unverified Remote Installer Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 66–70 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download remotely controlled scripts and pass their contents directly to `bash` or PowerShell's `Invoke-Expression`. The commands do not pin a reviewed release, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded payload before execution. HTTPS protects transport under normal conditions but does not establish that the retrieved script is immutable or safe. The effective code can change after the Skill has been reviewed. Compromise of the hosting service, deployment infrastructure, DNS or certificate trust chain, or the publisher account could consequently turn these installation commands into an arbitrary code-execution channel. Installing the required CLI is related to the declared functionality. However, executing a mutable network response directly in a shell exceeds the minimum privileges and trust required to install that dependency safely. ### Attack Path 1. The `oo` command is unavailable, or a command fails in a manner interpreted as the CLI being absent. 2. The Agent or user follows the first-time setup instructions in `SKILL.md`. 3. `curl` or `Invoke-RestMethod` retrieves the current script from `cli.oomol.com`. 4. The response is passed directly to a local command interpreter without integrity or authenticity verification beyond HTTPS. 5. If the remote script or its delivery infrastructure has been compromised, attacker-controlled commands execute with the privileges of the invoking account. 6. The payload may then access local files and credentials availab ...[truncated 1080 chars]
Remediation
## Remediation Suggestions 1. Remove the `curl | bash` and `irm | iex` installation patterns. 2. Pin the CLI to a specific, reviewed release rather than retrieving a mutable installer endpoint. 3. Download the installer or release artifact to a local file without executing it immediately. 4. Publish and verify a cryptographic checksum and, preferably, a trusted digital signature before execution. 5. Display the exact version, source URL, expected digest, and intended filesystem changes to the user. 6. Require explicit user approval before installing software or executing any downloaded artifact. 7. Prefer a trusted platform package manager with version locking and package-signature verification. 8. Run installation with ordinary user privileges unless elevated privileges are demonstrably necessary. 9. Fail closed if signature or checksum validation is unavailable or unsuccessful. 10. Keep the existing behavior of attempting connector actions before suggesting setup, but provide non-executing installation documentation when the CLI is absent. A safer shell workflow would download a pinned artifact, verify its published digest or signature, and only then invoke the verified local file after user approval.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
95% confidence
Finding
The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`), which executes network-fetched code without prior verification. If the install endpoint, transport, hosting, or supply chain is compromised, this can lead to arbitrary code execution on the host running the skill setup.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description says to use this skill for ANY NetEase Mail request and instead of calling the API directly, which is overly broad routing guidance. That can cause an agent to invoke a high-privilege mail skill on loose keyword matches, increasing the chance of unnecessary access to mailbox contents or accidental write/destructive operations in the wrong context.

Static analysis

No suspicious patterns detected.