ClawHub
Back to skill

Security audit

Rebrandly

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing Rebrandly, but its setup instructions use unverified remote installer scripts that can execute code on the user's machine.

Review this skill before installing. It should only be used if you trust OOMOL and the oo CLI, and you should avoid letting an agent run the curl|bash or irm|iex installer commands. Prefer installing the CLI through a verified, versioned, checksum- or signature-checked method, and explicitly confirm any Rebrandly create, update, or delete action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Shell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:61
Vulnerability Type: Remote payload retrieval and execution through a shell pipeline
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a mutable response from an external server directly into Bash. The downloaded script is neither pinned to a specific release nor validated using a cryptographic checksum or signature. It is also not saved for inspection before execution.

Although installing the oo CLI supports the declared Rebrandly integration, immediate remote-to-shell execution exceeds the minimum privileges and trust necessary to install that dependency safely. HTTPS protects the connection in transit but does not mitigate compromise of the hosting server, publishing account, DNS infrastructure, or installer itself. Because the effective payload can change after the Skill has been reviewed, the behavior constitutes a remote code execution and supply-chain risk.

Attack Path

  1. The oo command is unavailable, or an attacker causes the command to appear unavailable.
  2. The agent follows the documented first-time setup instruction.
  3. curl retrieves the current contents of https://cli.oomol.com/install.sh.
  4. The response is streamed directly to Bash without integrity verification or review.
  5. A compromised or malicious response executes arbitrary shell commands with the privileges of the user running the agent.

Impact Assessment

A malicious installer could read or modify any files accessible to the invoking user, steal local credentials or session data, install additional software, alter shell configuration, or establish persistence. If the command is run from an elevated account or subsequently requests elevation, the impact could extend to system-wide compromise. The reviewed file does not itself demonstrate that the current remote sc ...[truncated 85 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Prefer a trusted package manager or a versioned release artifact pinned to an explicit version.
  • Publish and verify a cryptographic checksum or signature before executing the installer.
  • Download the installer to a local file first, present its source and expected version to the user, and require explicit approval before execution.
  • Run installation with ordinary user privileges and avoid automatic privilege elevation.
  • Document the files, directories, and configuration changes made by the installer.
  • Where possible, require users to install the CLI independently rather than allowing the agent to execute installation code.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote PowerShell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:65
Vulnerability Type: Remote payload retrieval and execution through PowerShell
Risk Level: High

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction retrieves a mutable PowerShell script using Invoke-RestMethod and immediately evaluates it using Invoke-Expression. No release version, content hash, or digital signature is checked before execution, and the script is not retained for inspection.

Installation of the required CLI is related to the Skill's stated functionality, but executing arbitrary remote text through iex is not a least-trust installation mechanism. The payload served by the URL can change independently of the audited Skill. HTTPS alone cannot protect against compromise of the hosting infrastructure, publishing credentials, or upstream installer.

Attack Path

  1. The oo CLI is missing, or the agent receives a command-not-found result.
  2. The agent follows the Windows first-time setup instruction.
  3. Invoke-RestMethod downloads the current remote PowerShell content.
  4. The response is passed directly to Invoke-Expression.
  5. A compromised response executes arbitrary PowerShell commands in the invoking user's security context.

Impact Assessment

The payload could access files and credentials available to the user, modify PowerShell profiles or user configuration, download additional payloads, tamper with local tools, or create persistence. Execution from an administrator session could permit system-wide changes. The audited content does not establish that the currently hosted installer is malicious; the risk results from granting a mutable, unverified remote payload immediate code-execution capability.

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Distribute the CLI through a trusted Windows package manager or a versioned, signed release package.
  • Require Authenticode signature validation and a published cryptographic hash before execution.
  • Download the installer to a local file, verify it, and obtain explicit user approval before running it.
  • Execute installation without administrator privileges unless a documented operation strictly requires elevation.
  • Pin the installer and CLI to reviewed versions rather than using a mutable unversioned endpoint.
  • Prefer instructing the user to perform installation independently instead of permitting automatic agent-driven installation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install the CLI via a remote script piped directly into bash, which executes whatever content is served at that URL without prior verification. If the install endpoint, transport, CDN, or upstream release process were compromised, this would enable arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description says to use this skill for "ANY Rebrandly request" and "Whenever a task involves Rebrandly," which is extremely broad and lacks boundaries or exclusion conditions. This can overlap with many ordinary requests that merely mention Rebrandly, making activation scope ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.