ClawHub
Back to skill

Security audit

RAWG

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent read-only RAWG connector, but its setup instructions tell an agent to run unverified remote installer scripts if the CLI is missing.

Use the skill for RAWG reads only after the oo CLI is already installed and connected. Do not let an agent run the documented pipe-to-shell or irm-to-iex installer automatically; install the CLI through a reviewed official method, verify what will run, and understand that OOMOL account connection and billing may be required.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:75
Finding

Unverified Remote Installation Script Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 75
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable script from an external URL and pipes the response directly into Bash. The script is executed without version pinning, signature or checksum verification, local inspection, or confirmation of its final contents.

Although the URL uses HTTPS and belongs to the service named by the Skill, the executable payload is not included in the audited project and can change after review. Compromise of the remote host, publishing account, DNS/TLS path, or installation script could consequently turn this instruction into arbitrary code execution.

Installing software is not required for the Skill's core operation when the oo CLI is already available. Directly executing an unverified installer also exceeds the minimum privileges needed to perform read-only RAWG queries.

Attack Path

  1. The oo CLI is absent, causing an action to fail with oo: command not found.
  2. The Agent or user follows the documented first-time setup instruction.
  3. curl downloads the current contents of https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without verification or inspection.
  5. Any malicious or compromised content in that response executes with the privileges of the user running the command.

Impact Assessment

A compromised installer could execute arbitrary commands with the invoking user's privileges. This could expose files, credentials accessible to that user, shell configuration, and environment data; modify user-owned files; install additional software; or establish persistence where the current account has permission. The audited file does not prove that the current installer performs these ac ...[truncated 81 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe a network response directly into a shell.
  • Prefer an official, version-pinned package from a trusted package manager or a versioned release artifact.
  • Publish and verify a cryptographic checksum or digital signature before execution.
  • Download the installer to a local file, inspect it, and execute it only after explicit user approval.
  • Pin the expected installer or CLI version so the effective code cannot change silently after the Skill is reviewed.
  • Keep installation outside normal Skill execution and document it as a manual prerequisite.
  • Run installation with standard-user privileges unless a specific, documented operation requires elevation.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:79
Finding

Unverified Remote Installation Script Executed Through PowerShell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 79
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and immediately evaluates it with Invoke-Expression (iex). No version is pinned, and the downloaded content is not authenticated with a signature or checksum before execution.

HTTPS protects the connection under normal conditions but does not ensure that the publisher's current script is identical to the script that existed when the Skill was audited. If the hosting infrastructure, publishing credentials, domain resolution, TLS trust path, or remote script is compromised, attacker-controlled PowerShell commands can be delivered through this instruction.

The behavior is unnecessary for normal RAWG query execution when the CLI is installed and exceeds the minimum privileges required for the Skill's declared read-only functionality.

Attack Path

  1. The oo CLI is unavailable on a Windows system.
  2. The Agent or user follows the PowerShell setup instruction.
  3. irm retrieves the current response from https://cli.oomol.com/install.ps1.
  4. The response is sent directly to iex, without a verification or review step.
  5. Modified or malicious response content executes in the current PowerShell process with the invoking user's privileges.

Impact Assessment

A compromised response could run arbitrary PowerShell commands within the current user's security context. Potential scope includes reading accessible files and credentials, modifying user data or PowerShell profiles, downloading further payloads, and creating persistence where permitted. Administrator-level impact would require the command to be run in an elevated process or a separate privilege-es ...[truncated 63 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex installation pattern.
  • Distribute the CLI through a trusted, version-pinned package or signed release artifact.
  • Require Authenticode signature validation or verification against a separately published cryptographic checksum.
  • Download the script to a file and require explicit user review and approval before execution.
  • Pin the expected CLI and installer versions.
  • Treat installation as a manual prerequisite rather than an automatic fallback action.
  • Avoid elevated PowerShell sessions unless elevation is explicitly required and justified.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent to install software by piping a remote script directly into a shell (curl ... | bash). This pattern is dangerous because it executes unverified code fetched at runtime, enabling supply-chain compromise, man-in-the-middle risk, or execution of altered installer content with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says to use this skill for "ANY RAWG request" and "Whenever a task involves RAWG," which is a very broad activation condition. It does not define boundaries or exclusions, so ordinary mentions of RAWG-related topics could trigger the skill even when direct API use or another workflow might be more appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.