ClawHub
Back to skill

Security audit

News API

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent News API connector, but its first-time setup tells agents to run unverified remote installer scripts directly in a shell.

Review this skill before installing. Its normal News API commands are narrowly scoped through the oo CLI, but do not let an agent run the listed curl-to-bash or PowerShell installer automatically. Install the oo CLI manually from a trusted, verified source, and only sign in or connect News API when you intentionally want this connector to use your OOMOL account.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unpinned Remote Installer Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:58-62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The first-time setup instructions execute remotely hosted, mutable installer scripts directly in Bash or PowerShell:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both commands combine network retrieval with immediate interpreter execution. The downloaded content is not pinned to a reviewed version and is not subject to checksum validation, digital-signature verification, or inspection before execution. Consequently, the code ultimately executed can change after the Skill itself has been audited.

TLS protects the connection in transit but does not establish that the current installer content matches an audited release. Compromise of the hosting service, publication pipeline, domain, DNS or certificate trust chain could cause arbitrary attacker-controlled commands to be returned and executed.

Installing the required CLI may be legitimate, and the instructions are only presented as a fallback when oo is missing. However, direct pipe-to-shell execution is not the minimum privilege or safest mechanism necessary to support the declared News API functionality. There is no evidence in the reviewed file that the current OOMOL installer is itself malicious; the vulnerability is the unverified remote execution mechanism.

Attack Path

  1. The oo CLI is unavailable, and setup reaches the documented first-time installation procedure.
  2. An attacker compromises or gains control over the installer response through the hosting or release pipeline, domain infrastructure, or another trusted delivery component.
  3. The victim or agent runs the documented Bash or PowerShell installation command.
  4. curl or Invoke-RestMethod retrieves the attacker-controlled response.
  5. Th ...[truncated 884 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove direct curl | bash and Invoke-RestMethod | Invoke-Expression installation commands from the Skill.
  2. Prefer a trusted platform package manager or a version-pinned installer published through a verified release channel.
  3. If a standalone artifact is required, download it without executing it, pin an explicit version, and verify a publisher-signed checksum or cryptographic signature before use.
  4. Publish expected hashes and signatures through an independently protected release channel, and fail closed when verification fails.
  5. Require explicit user approval before installing software; installation should not occur automatically as part of a News API request.
  6. Run the installer with ordinary user privileges unless a documented operation strictly requires elevation. Avoid requesting broad or persistent permissions.
  7. Present the artifact and verification result before execution, and retain an auditable record of the selected version.
  8. Keep the existing assumption that the CLI is already installed, but direct users to a reviewed installation guide rather than embedding mutable remote-code execution commands.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software via a remote script piped directly into a shell (curl ... | bash). That pattern executes network-fetched code without verification, so a compromised host, MITM, DNS hijack, or upstream supply-chain incident could lead to arbitrary code execution on the machine running the skill.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use this skill for "ANY News API request" and "Whenever a task involves News API, use this skill," which is a broad activation condition for a markdown file. It does not provide exclusions, negative examples, or narrower constraints, so ordinary mentions of News API could unintentionally match.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.