ClawHub
Back to skill

Security audit

Personal AI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for connecting to Personal AI, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Install only if you are comfortable using OOMOL as an intermediary for Personal AI actions and sending selected content to that service. Do not run the curl-to-bash or PowerShell iex installer blindly; prefer a signed package, pinned release, checksum/signature verification, or manual inspection before installing the oo CLI.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

markdown
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
text

### Technical Analysis

The documented commands download mutable scripts from `cli.oomol.com` and immediately execute them with Bash or PowerShell. This prevents users from inspecting the retrieved payload before execution and provides no cryptographic verification, checksum validation, release pinning, or publisher-signature validation.

HTTPS protects data in transit but does not guarantee that the server, publishing pipeline, DNS infrastructure, or current hosted payload has not been compromised. Because the remote scripts can change after the Skill package has been audited, the code ultimately executed is outside the reviewed artifact.

Installing the required CLI may be legitimate for the declared Personal AI connector functionality. However, executing an unpinned remote script directly exceeds the minimum safe integrity requirements for installation. The reviewed content does not establish that the remote script is currently malicious, but the installation mechanism creates a critical supply-chain code-execution channel.

### Attack Path

1. An attacker compromises `cli.oomol.com`, its DNS or hosting infrastructure, or the installer publication pipeline.
2. The attacker replaces `install.sh` or `install.ps1` with a malicious payload.
3. The `oo` command is unavailable, causing the documented first-time setup path to be used.
4. A user or agent runs the supplied `curl | bash` or `irm | iex` command.
5. The shell executes the attacker-controlled payload immediately
...[truncated 969 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation instructions.
  2. Pin installation to a specific, immutable CLI release rather than a mutable installer URL.
  3. Download the package to disk without executing it, then verify a hard-coded SHA-256 digest or a trusted publisher signature before installation.
  4. Publish checksums and signatures through an independently secured release channel.
  5. Prefer signed packages distributed through trusted platform package managers.
  6. Allow the user to inspect the downloaded artifact and installation steps before execution.
  7. Require explicit user approval before downloading or installing executable software.
  8. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation.
  9. Document the exact files, permissions, and system changes made by the installer.
  10. Fail closed when integrity or signature verification cannot be completed.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly from the network without prior verification, integrity checking, or review. If the distribution endpoint, transport, or hosting account is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger text says to use this skill for "ANY Personal AI request," which is overly broad and can cause the agent to route many loosely related tasks into a powerful connector skill without clear scoping constraints. In a tool-routing context, this increases the chance of unnecessary invocation of state-changing capabilities and makes prompt/intent confusion more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.