ClawHub
Back to skill

Security audit

OptimoRoute

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing OptimoRoute through OOMOL, but its first-time setup tells agents to execute unverified remote installer scripts.

Review this before installing. The OptimoRoute connector behavior is clearly described and destructive actions require confirmation, but do not let an agent run the listed remote installer pipelines automatically. Install the oo CLI through verified, user-controlled steps and confirm any write or delete payload before execution.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Shell Script Execution via curl and Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 57
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a remotely retrieved script directly into Bash. The downloaded content is not pinned to a version or cryptographic digest and is not inspected or signature-verified before execution. Consequently, the code that executes can differ from the content present when this skill was audited.

HTTPS protects data in transit under normal conditions but does not establish that the server's current payload is trustworthy. Compromise of the hosting service, DNS or certificate infrastructure, deployment pipeline, or vendor account could cause arbitrary shell commands to be delivered. The instruction is only presented as a fallback when oo is absent, which limits routine exposure, but remote code execution is broader than the minimum permission required merely to document or invoke the OptimoRoute connector.

Attack Path

  1. A user or agent attempts to use the skill on a system where the oo command is unavailable.
  2. The documented fallback directs it to request https://cli.oomol.com/install.sh.
  3. An attacker compromises or gains control over the script distribution path and replaces the expected installer with a malicious payload.
  4. curl streams that payload directly to Bash without local review, version pinning, checksum validation, or signature verification.
  5. The payload executes immediately with the privileges of the user running the command.

Impact Assessment

A substituted installer could execute arbitrary commands with the invoking user's permissions. This may permit access to readable credentials and local files, alteration of shell configuration or executables, installation of persistence mechanisms ...[truncated 315 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe downloaded content directly into a shell.
  • Prefer a version-pinned package from a trusted package manager or a signed release artifact.
  • If a script is required, download it to a local file, verify a publisher signature or a documented SHA-256 digest, inspect it, and only then execute it.
  • Pin installation instructions to an immutable release version rather than a mutable install.sh endpoint.
  • Run installation with ordinary user privileges and avoid requesting administrator privileges unless a documented operation strictly requires them.
  • Keep installation user-initiated and separate from normal skill execution.
  • Publish expected checksums and signing-key verification instructions through an independent, authenticated channel.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote PowerShell Script Execution via Invoke-RestMethod

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

irm is an alias for Invoke-RestMethod, while iex is an alias for Invoke-Expression. This pipeline retrieves text from a mutable external URL and evaluates it immediately as PowerShell code. There is no fixed version, local inspection step, checksum, or digital-signature validation.

The effective executable payload is therefore controlled by the content served from the external endpoint at invocation time rather than by the audited skill package. Although this instruction is a first-time setup fallback, it creates a code-execution channel whose privileges are not inherently constrained to installing or operating the declared OptimoRoute connector.

Attack Path

  1. A Windows user or agent attempts to use the skill without the oo CLI installed.
  2. The setup documentation directs PowerShell to retrieve https://cli.oomol.com/install.ps1.
  3. An attacker compromises the hosting endpoint, release pipeline, vendor credentials, or another trusted component of the delivery path.
  4. The attacker serves PowerShell commands in place of the legitimate installer.
  5. Invoke-Expression evaluates the response immediately without integrity or authenticity verification.
  6. The attacker-controlled commands run in the current PowerShell security context.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The payload could read accessible files and credentials, modify user configuration, download further components, transmit information, or establish persistence where local permissions permit. Execution from an elevated PowerShell session could result in system-wide ef ...[truncated 173 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the Invoke-RestMethod | Invoke-Expression installation pattern.
  • Use a signed, version-specific installer or a trusted package repository.
  • Download the installer as a file and validate its Authenticode signature and a publisher-provided cryptographic checksum before execution.
  • Pin the artifact to an immutable release and document the expected signer identity.
  • Execute installation under a standard user account unless explicitly documented operations require elevation.
  • Require deliberate user review and consent before installation; the skill should never perform this setup automatically.
  • Keep CLI installation isolated from connector actions so normal OptimoRoute usage cannot trigger unrestricted installer execution.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill instructs the agent to install software by piping a remote script directly into bash, which is a classic unsafe pattern because it executes unverified code fetched at runtime. In this skill context, the command appears in a fallback setup section rather than the primary workflow, but it is still dangerous because a compromised host, CDN, DNS path, or vendor endpoint could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Static analysis

No suspicious patterns detected.