ClawHub
Back to skill

Security audit

OpenPageRank

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent OpenPageRank connector, but its fallback setup tells users or agents to execute remote installer scripts directly without verification.

Review the setup path carefully before installing. The OpenPageRank lookup behavior is narrow and read-only, but the fallback installer commands execute code downloaded at install time; prefer a verified, pinned, or package-manager installation of the oo CLI and avoid running the installer from an elevated shell.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:55
Finding

Remote Shell Script Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 55
Vulnerability Type: Remote payload retrieval and execution through curl | bash
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command retrieves a shell script from an external URL and pipes it directly into Bash. The script is executed before the user can inspect its contents, and the project does not specify an immutable version, cryptographic checksum, or publisher signature.

Although HTTPS protects the connection against ordinary in-transit modification and the hostname is consistent with the declared OOMOL service, it does not guarantee that the remotely hosted script will remain unchanged after this Skill has been reviewed. Compromise of the domain, hosting infrastructure, CDN, deployment pipeline, or publisher account could therefore turn this installation step into an arbitrary-code execution channel.

Installing the CLI may be relevant to the Skill's operation, but immediate execution of mutable remote content exceeds the minimum privileges and trust required for installation. A verified package or separately downloaded and authenticated installer would provide the same functionality with less risk.

Attack Path

  1. The oo command is unavailable on the user's macOS or Linux system.
  2. The agent or user follows the first-time setup instructions in SKILL.md.
  3. curl downloads the current content of https://cli.oomol.com/install.sh.
  4. Bash executes the response immediately, without local review or cryptographic verification.
  5. If the remote delivery infrastructure or installer has been compromised, attacker-controlled commands run with the privileges of the user who invoked the command.
  6. The payload can then access data available to that account, alter user-owned files and configuration, install persistence where permitted, or invoke further network activity.

Impact As

...[truncated 654 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the pipe-to-shell command with installation through a trusted package manager using an exact, reviewed version.
  • If a standalone installer is required, download it to a local file without executing it:
    1. Retrieve a versioned release artifact.
    2. Verify a publisher signature or a SHA-256 digest obtained through an independently authenticated channel.
    3. Allow inspection of the downloaded script.
    4. Execute it as a separate step only after successful verification.
  • Pin the installer or CLI to an immutable release rather than an unversioned URL.
  • Publish signed release metadata and document the expected signing identity.
  • Do not request administrator privileges unless a specific installation operation requires them.
  • Prefer installation into a user-controlled directory with narrowly scoped filesystem permissions.
  • Document the files, configuration changes, and network destinations used by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Remote PowerShell Script Downloaded and Immediately Evaluated

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Remote payload retrieval and execution through Invoke-RestMethod | Invoke-Expression
Risk Level: High

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell command uses irm (Invoke-RestMethod) to retrieve a script from an external server and sends the returned content directly to iex (Invoke-Expression). This evaluates the response as PowerShell code in the current process.

The project provides no pinned release, Authenticode verification, cryptographic digest, or review step. Consequently, the code that executes can differ from the content available when the Skill was audited. HTTPS alone does not protect against compromise of the authorized publisher, hosting account, CDN, deployment pipeline, or origin server.

This execution pattern also reduces transparency because the payload is not retained as a local artifact for inspection before execution. While installing the oo CLI supports the declared functionality, direct evaluation of mutable network content is not the least-risk method of performing that installation.

Attack Path

  1. The oo CLI is not installed on a Windows system.
  2. The agent or user follows the first-time setup instructions.
  3. Invoke-RestMethod retrieves the current response from https://cli.oomol.com/install.ps1.
  4. The response is passed directly to Invoke-Expression.
  5. If the remote script or its delivery infrastructure has been compromised, attacker-provided PowerShell runs with the current process's privileges.
  6. The payload can read accessible local data, modify the user's PowerShell profile or other configuration, download additional payloads, and create persistence where the account has permission.

Impact Assessment

Successful exploitation results in arbitrary PowerShell execution under the invoking user's security context. An att ...[truncated 407 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct irm | iex execution pattern.
  • Distribute the CLI as a versioned, signed package through a reputable Windows package manager or as a signed installer.
  • If a PowerShell installer remains necessary:
    1. Download it to a local file.
    2. Pin the installer to an immutable release.
    3. Validate its Authenticode signature and expected publisher certificate.
    4. Verify a published cryptographic digest.
    5. Inspect the file before invoking it with PowerShell.
  • Use a restrictive execution policy and avoid bypass flags.
  • Run installation with standard-user privileges unless a documented operation strictly requires elevation.
  • Document expected filesystem, registry, profile, and network changes so users can validate installer behavior.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk: if the remote host, transport, installer, or distribution path is compromised, arbitrary code will execute immediately with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use this skill for "ANY OpenPageRank request" and "Whenever a task involves OpenPageRank," which is a very broad activation condition without constraints or negative examples. In a manifest/markdown context, this can cause unintended invocation for loosely related mentions of OpenPageRank rather than clearly scoped actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.