ClawHub
Back to skill

Security audit

OpenWeather

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for OpenWeather access, but its setup instructions tell users to run remote installer scripts directly, which warrants review before installation.

Review the first-time setup before installing. Prefer installing the oo CLI through a verified, signed, or package-manager method, and do not run the remote shell or PowerShell installer pipeline unless you trust the publisher and understand the system changes it may make. For normal OpenWeather use, confirm any write or delete action payload before allowing it to run.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:75
Finding

Unverified Remote Shell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 75
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable script from an external URL and pipes it directly into Bash. The downloaded content is not displayed for review, pinned to an immutable version, or validated with a cryptographic signature or known checksum before execution.

Although HTTPS protects the network connection against ordinary interception, it does not guarantee that the server, hosting account, DNS configuration, or future installer content will remain trustworthy. The effective executable payload can therefore change after the Skill package has been reviewed.

Installing the oo CLI is only a first-time fallback when the command is unavailable, but automatic remote-script execution exceeds the minimum privileges needed for the Skill's declared OpenWeather operations. The weather operations themselves only require an already installed CLI with connector access.

Attack Path

  1. The user or agent attempts to use the Skill on a system where oo is unavailable.
  2. The setup instructions direct it to execute the curl | bash pipeline.
  3. The current response from https://cli.oomol.com/install.sh is passed directly to Bash.
  4. If the distribution endpoint or installer has been compromised, attacker-controlled shell commands execute without prior integrity verification.
  5. Those commands operate with all permissions available to the invoking user and can subsequently modify the local environment or access user-readable data.

Impact Assessment

A malicious installer could execute arbitrary commands with the invoking user's privileges. Depending on those privileges and the installer content, this could expose local files, environme ...[truncated 537 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation command from agent-executable instructions.
  • Require installation to be initiated explicitly by the user rather than automatically by the Skill.
  • Prefer a trusted operating-system package manager or a version-pinned release artifact.
  • Download the installer to a local file before execution so it can be inspected.
  • Publish and verify a cryptographic signature or a SHA-256 checksum obtained through an independently trusted channel.
  • Pin the download to an immutable release version instead of a mutable install.sh endpoint.
  • Run installation with ordinary user privileges and document any permissions genuinely required.
  • Stop and report an error if integrity verification fails; never fall back to executing unverified content.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:79
Finding

Unverified Remote PowerShell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 79
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and sends the response directly to Invoke-Expression (iex). PowerShell consequently interprets the network response as code without local review, version pinning, signature validation, or checksum verification.

The payload served by the external endpoint can change independently of the audited Skill. HTTPS alone does not protect against compromise of the legitimate server or publication pipeline. If the endpoint returns hostile PowerShell, it receives the same execution context and accessible resources as the invoking PowerShell process.

This installation behavior is not necessary for routine OpenWeather connector requests when the CLI is already installed. It expands the Skill's effective capability from invoking the restricted oo command to executing arbitrary code supplied by a remote service.

Attack Path

  1. The Skill is used on a Windows system where the oo CLI is missing.
  2. The user or agent follows the first-time setup instruction.
  3. irm retrieves the current content of https://cli.oomol.com/install.ps1.
  4. The response is passed immediately to iex and interpreted as PowerShell code.
  5. A compromised or malicious response executes with the permissions of the current PowerShell process.
  6. The payload can access user-readable resources and perform any system operation permitted to that process.

Impact Assessment

Successful exploitation provides arbitrary PowerShell execution under the invoking user's security context. Potential effects include disclosure of accessible files and credentials, modification of user c ...[truncated 455 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pipeline and do not permit the agent to execute remote installation content automatically.
  • Use a signed, version-pinned Windows package or immutable release artifact.
  • Download the PowerShell installer separately and validate its Authenticode signature and expected publisher before execution.
  • Publish a SHA-256 digest through an independently trusted channel and verify it in addition to transport security.
  • Require explicit user approval after displaying the exact version, source, integrity result, and expected system changes.
  • Execute the installer with the lowest practical privileges and avoid administrator PowerShell unless strictly necessary.
  • Configure PowerShell to stop on signature or integrity-check failure rather than executing an unverified fallback.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly without prior verification or integrity checking. If the hosting endpoint, TLS trust chain, or distribution pipeline is compromised, arbitrary code could run on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY OpenWeather request" and "Whenever a task involves OpenWeather," which is extremely broad and lacks boundaries or exclusion conditions. This can overlap with many ordinary weather-related tasks without clarifying when the skill should not activate or whether narrower triggers are preferred.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.