ClawHub
Back to skill

Security audit

NextDNS

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only NextDNS connector helper, but its setup instructions tell users to run mutable remote installer scripts without verification.

Review before installing. The NextDNS operations shown are read-only, but do not run the suggested curl|bash or irm|iex installer unless you trust OOMOL's installer endpoint and are comfortable executing remote code without a pinned version or integrity check. Prefer installing the oo CLI through a verified package or inspected release artifact if available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Shell Script Execution via curl and bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The first-time setup instructions pipe a remotely retrieved installation script directly into bash. The script is not pinned to an immutable release, downloaded for inspection, or verified with a cryptographic signature or trusted checksum before execution.

Although HTTPS protects the network connection in transit, it does not guarantee that the served script remains identical to the version reviewed with this Skill. Compromise of the hosting server, domain, publishing account, TLS termination infrastructure, or installer generation process could cause arbitrary replacement code to be executed.

Installing a CLI may be necessary for the documented workflow, but immediate execution of a mutable remote script exceeds the minimum privilege and trust required to perform read-only NextDNS queries. The Skill could instead require an already installed CLI or provide a verified, version-pinned installation process.

Attack Path

  1. A user requests a NextDNS operation through the Skill.
  2. The oo command is unavailable, causing the user or Agent to consult the first-time setup instructions.
  3. The installer endpoint or its publishing infrastructure is compromised or serves a modified script.
  4. curl retrieves the attacker-controlled response.
  5. The pipe sends that response directly to bash without inspection or integrity verification.
  6. The payload executes with all permissions available to the account that launched the command.

Impact Assessment

The remote payload can execute arbitrary shell commands with the invoking user's privileges. It could read or modify accessible files, collect local credentials and environment data, alter shell configuration, install additional software, or ...[truncated 395 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash installation pattern.
  2. Pin installation instructions to a specific audited CLI version from an official release channel.
  3. Download the installer or binary to a local file without executing it immediately.
  4. Publish and verify a cryptographic signature using a separately distributed trusted public key. At minimum, verify a hard-coded SHA-256 checksum corresponding to the pinned release.
  5. Execute the verified artifact explicitly only after successful validation.
  6. Document the files, network endpoints, and permissions used by the installer.
  7. Avoid requesting elevated privileges unless a specific installation step requires them.
  8. Prefer an operating-system package manager with package-signing and version-pinning support where available.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote PowerShell Script Execution via Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows setup instruction retrieves a PowerShell script with Invoke-RestMethod (irm) and immediately evaluates it using Invoke-Expression (iex). No release version, Authenticode signature, cryptographic checksum, or immutable artifact identity is verified first.

This pattern treats all content returned by the remote endpoint as trusted PowerShell code. The effective payload can therefore change independently of the reviewed SKILL.md. HTTPS alone does not protect against compromise of the legitimate publisher or hosting infrastructure.

The ability to execute arbitrary mutable PowerShell content is broader than required for the Skill's declared read-only NextDNS functionality. A separately downloaded and verified CLI package would satisfy the installation requirement with substantially less supply-chain exposure.

Attack Path

  1. A Windows user attempts to use the Skill without the oo CLI installed.
  2. The user follows the first-time setup instruction.
  3. An attacker compromises the installer endpoint, publishing process, or another trusted component in its delivery chain.
  4. Invoke-RestMethod downloads the substituted PowerShell payload.
  5. Invoke-Expression evaluates the response directly, with no opportunity for integrity validation or review.
  6. The payload performs arbitrary actions under the current PowerShell process's security context.

Impact Assessment

An attacker-controlled installer could access files and credentials available to the current Windows user, modify user configuration, download additional payloads, or create persistence mechanisms. If PowerShell is running with administrative privileges, the payload could potentially modify system-w ...[truncated 278 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the irm | iex installation instruction.
  2. Link to a version-pinned, official release package rather than a mutable script endpoint.
  3. Download the package to disk before executing or importing it.
  4. Require validation of an Authenticode signature from an explicitly trusted publisher, or verify a pinned cryptographic digest obtained through an independent trusted channel.
  5. Reject unsigned, invalidly signed, unexpectedly versioned, or checksum-mismatched packages.
  6. Run installation with standard-user privileges unless an explicitly documented operation requires elevation.
  7. Provide users with the expected publisher identity, version, checksum, installation effects, and uninstall procedure.
  8. Prefer a signed package distributed through a trusted Windows package manager where practical.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly without verification. If the remote host, transport, or script is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest markets the skill as limited to 'searching and reading data', but the body explicitly discusses [write] and [destructive] actions and provides a generic execution path for any action name. This mismatch can cause an invoking agent or user to over-trust the skill as read-only when it may be used for state-changing operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrase says to use this skill for ANY NextDNS request, which is overly broad and can route both harmless reads and sensitive administrative tasks through the same skill. In context, that increases the chance an agent will invoke it for operations outside the intended safe scope, especially given the generic action runner and mention of write/destructive actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The safety section says untagged actions are reads, but the operational instructions tell the agent to supply any <action_name> after fetching schema, without technical enforcement of a read-only allowlist. That creates a policy/control gap where an agent may execute mutating or future-added actions that are not reflected in the documented list or tags.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.