ClawHub
Back to skill

Security audit

Plisio

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing Plisio through OOMOL, but its setup instructions tell users to run an unverified remote installer directly in a shell.

Review this skill before installing. Its Plisio actions are understandable and include confirmation guidance for invoice creation, but do not run the remote installer commands as written unless you independently trust and verify the OOMOL CLI installer. Prefer installing the CLI through a pinned, signed, or package-manager-based method and confirm any Plisio write payload before execution.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions pipe a remotely retrieved installer directly into Bash and use Invoke-Expression to execute a remotely retrieved PowerShell script. The downloaded content is executed without pinning an immutable release, verifying a cryptographic signature or checksum, or providing an opportunity to inspect the script.

Although installing the oo CLI is relevant when the required command is unavailable, immediate execution of mutable remote content is not the minimum safe installation mechanism. HTTPS only protects the connection in transit; it does not mitigate compromise of the hosting service, publication account, infrastructure, or installer itself. The effective payload can also change after this Skill has been audited.

Attack Path

  1. A user or agent attempts to use the Skill on a system where the oo command is unavailable.
  2. The Skill directs the user or agent to retrieve an installer from cli.oomol.com.
  3. An attacker compromises the remote installer, its hosting infrastructure, or an authorized publishing mechanism.
  4. The server returns attacker-controlled shell or PowerShell code.
  5. The pipeline passes the response directly to Bash or Invoke-Expression, with no integrity verification or review.
  6. The malicious payload executes with the privileges of the user running the installation command.

Impact Assessment

A compromised installer could execute arbitrary commands with the invoking user's privileges. This could expose files and locally accessible credentials, modify user configuration, install additional ...[truncated 304 chars]

Remediation
View remediation

Remediation Suggestions

Replace both direct-execution patterns with a verifiable installation process:

  1. Link to an immutable, version-pinned release artifact from the official distribution repository.
  2. Download the installer or binary to a local file rather than piping the response into a shell.
  3. Publish and require verification of a SHA-256 checksum or, preferably, a cryptographic signature backed by a documented trusted key.
  4. Abort installation if verification fails.
  5. Allow the downloaded installer to be inspected before execution.
  6. Prefer a signed operating-system package or trusted package manager where available.
  7. Run installation with ordinary user privileges unless a specific installation step demonstrably requires elevation.
  8. Document the expected installer behavior, destination paths, files created, and permissions requested.

A safer conceptual workflow is: download a pinned artifact, verify its signature or checksum against an independently published value, and execute it only after successful verification.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This is dangerous because it executes unverified code from the network without integrity checks, version pinning, or user review, creating a supply-chain and remote code execution risk if the host, CDN, DNS, or connection is compromised.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Static analysis

No suspicious patterns detected.