ClawHub
Back to skill

Security audit

Productboard

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-oriented Productboard connector, but its setup instructions include unverified internet scripts that execute directly on the user's machine.

Review before installing. The Productboard access pattern is understandable for a connector skill, but avoid running the one-line installer commands unless you trust OOMOL's installer source and can verify what will execute. Prefer a pinned, checksum-verified, or package-manager installation path, and use the skill for read/list Productboard tasks rather than state-changing requests.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding

Unverified Remote Installation Scripts Are Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–71
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from cli.oomol.com and immediately execute them through Bash or PowerShell. The downloaded content is not pinned to a reviewed version and is not checked against a cryptographic hash or signature before execution.

Although installation is documented as a fallback used only when the oo CLI is missing, direct execution is not the minimum privilege or safest mechanism necessary to install a command-line utility. The effective code can change after this Skill has been reviewed. Compromise of the distribution server, publishing process, DNS/TLS environment, or remote scripts could therefore turn the documented setup procedure into arbitrary code execution.

The audit did not establish that the current remote scripts are malicious. The vulnerability is the trust model and unverified execution mechanism itself.

Attack Path

  1. The oo command is unavailable, causing the Agent or user to follow the first-time setup instructions.
  2. An attacker compromises the remote installation script, its publishing infrastructure, or the network trust path.
  3. curl or Invoke-RestMethod retrieves attacker-controlled script content.
  4. The shell pipe or Invoke-Expression executes that content immediately, without an inspection or integrity-verification step.
  5. The payload runs with the privileges of the user executing the installation command.

Impact Assessment

Successful exploitation provides arbitrary code execution under the installing user's account. The payload could read or alter files accessible to that account, steal locally av ...[truncated 787 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove both direct download-to-shell patterns.
  2. Distribute the CLI through a trusted platform package manager or a pinned release hosted in an auditable official repository.
  3. Download the installer or binary to disk without executing it automatically.
  4. Pin an explicit version rather than using a mutable generic installation URL.
  5. Publish and verify a cryptographic checksum and, preferably, a signed release before execution.
  6. Present the resolved source, version, checksum, and intended filesystem changes to the user.
  7. Require explicit user approval before installing or executing downloaded software.
  8. Run installation with ordinary user privileges unless a specific, documented operation strictly requires elevation.
  9. Provide manual installation commands that separate download, verification, inspection, and execution into distinct steps.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest promises the skill is only for searching and reading data, but the body instructs use of generic Productboard actions and discusses write/destructive operations. This mismatch can cause higher-privilege behavior than a caller or policy layer expects, enabling unintended state-changing operations under a read-scoped description.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
93% confidence
Finding

The skill recommends installing the CLI via a remote script piped directly to bash, which executes unreviewed code fetched at runtime. If the hosting site, network path, or script content is compromised, this becomes an arbitrary code execution path on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text says to use this skill for ANY Productboard request, which is overly broad and can cause automatic invocation for tasks beyond the intended read/search scope. In context, that broad routing is more dangerous because the skill documentation also permits generic actions, increasing the chance of unintended access or side effects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The safety model depends on write and destructive actions being clearly tagged, but the listed actions contain no such tags while the text says such tags exist. That ambiguity can lead an agent to treat actions as safe reads by default even if the connector later exposes mutating operations, weakening operator review and consent controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.