ClawHub
Back to skill

Security audit

remove.bg

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using remove.bg through OOMOL, but its setup instructions include unsafe remote installer commands that should be reviewed before installation.

Before installing, review the setup path carefully. Prefer installing the oo CLI through a verified official release or package manager flow instead of piping downloaded scripts directly into a shell, and confirm any upload, improvement submission, or account-affecting action before running it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Shell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 57
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a remotely retrieved script directly into Bash. Although HTTPS protects the connection in transit under normal conditions, it does not pin the script to the content reviewed with this Skill. The effective payload remains controlled by the remote host and can change at any time.

No version pinning, cryptographic checksum validation, signature verification, or local review step occurs before execution. If the hosting service, its deployment pipeline, DNS resolution, certificate trust chain, or publishing account is compromised, an attacker can replace the installer and obtain arbitrary shell execution.

Installation is relevant only when the oo CLI is unavailable, but automatic execution of a mutable script exceeds the minimum privilege necessary to document or invoke the declared remove.bg connector functionality.

Attack Path

  1. The oo command is unavailable and an authentication or connector operation fails because the CLI is not installed.
  2. The Agent follows the first-time setup instruction in SKILL.md.
  3. An attacker has compromised or gained publishing control over https://cli.oomol.com/install.sh, or otherwise causes the trusted HTTPS endpoint to return attacker-controlled content.
  4. curl downloads the current response without validating a pinned digest or signature.
  5. The shell pipeline passes the response directly to Bash.
  6. The attacker-controlled script executes with all privileges available to the current Agent or user process.

Impact Assessment

Successful exploitation provides arbitrary command execution under the current user's security context. Depending on that context ...[truncated 393 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe downloaded content directly into a shell.
  • Distribute a version-pinned release artifact through a documented package manager or trusted release channel.
  • Publish a cryptographic digest and a detached signature for each release.
  • Download the installer to a local file, verify its signature and digest against independently published values, and only then execute it.
  • Allow users to inspect the downloaded script before execution.
  • Run installation with an unprivileged account and request elevation only for narrowly defined operations that genuinely require it.
  • Keep installation outside normal Skill execution and require explicit user approval before running any installer.
  • Prefer guidance similar to:
bash
curl -fSLo oo-install.sh "https://cli.oomol.com/releases/<pinned-version>/install.sh"
echo "<trusted-sha256>  oo-install.sh" | sha256sum -c -
bash oo-install.sh

The expected digest must come from an authenticated, independently verifiable release channel rather than from the same mutable response.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote PowerShell Script Evaluation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The instruction uses Invoke-RestMethod (irm) to retrieve a PowerShell script and pipes the response directly to Invoke-Expression (iex). This evaluates the remote response as executable PowerShell code without version pinning, Authenticode validation, digest verification, or user inspection.

The code audited in the Skill therefore does not determine the code ultimately executed. Anyone able to modify the remote installer response can execute arbitrary PowerShell commands in the calling process. The use of Invoke-Expression also removes the separation between downloaded data and executable code.

Installing the CLI may support first-time setup, but evaluating mutable remote content directly is not required for the Skill's declared background-removal operations and exceeds a least-privilege setup model.

Attack Path

  1. A Windows user or Agent encounters oo: command not found.
  2. The first-time setup instructions are followed.
  3. An attacker compromises the installer endpoint, its publishing pipeline, or another component capable of controlling the trusted response.
  4. Invoke-RestMethod retrieves the attacker-controlled PowerShell source.
  5. The pipeline sends the response directly to Invoke-Expression.
  6. PowerShell executes the payload with the current process token, without validating the publisher or expected file contents.

Impact Assessment

Exploitation permits arbitrary PowerShell execution with the current user's permissions. This can expose accessible files, environment variables, browser or application data, and locally available authentication material. The payload could modify user profiles, replac ...[truncated 266 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm ... | iex pattern.
  • Provide a version-specific installer package from a trusted release page.
  • Download the installer without evaluating it, then verify both its expected SHA-256 digest and Authenticode signature.
  • Require a valid signature from an explicitly trusted publisher and reject unsigned, invalid, or unexpectedly signed content.
  • Present the verified file for user inspection and require explicit approval before execution.
  • Run installation without administrative rights unless a specific installation operation requires elevation.
  • Keep first-time installation separate from routine connector actions.
  • Use a hardened flow such as:
powershell
Invoke-WebRequest `
  -Uri "https://cli.oomol.com/releases/<pinned-version>/install.ps1" `
  -OutFile ".\install.ps1"

if ((Get-FileHash ".\install.ps1" -Algorithm SHA256).Hash -ne "<TRUSTED_SHA256>") {
    throw "Installer digest verification failed."
}

if ((Get-AuthenticodeSignature ".\install.ps1").Status -ne "Valid") {
    throw "Installer signature verification failed."
}

& ".\install.ps1"

The expected digest and publisher identity must be obtained through an authenticated release process independent of the downloaded installer.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software via curl ... | bash, which executes a remote script directly without verification, pinning, or integrity checks. If the remote host, transport, or distribution path is compromised, this becomes arbitrary code execution on the user's machine; because it appears in a fallback setup path, an agent may surface or run it during error recovery.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text is overly broad: "Use this skill for ANY remove.bg request" can cause the agent to invoke this skill whenever remove.bg is merely mentioned, even if the user did not intend to use this connector or a safer/direct path exists. In an agentic system, overbroad routing increases the chance of unintended actions, unnecessary credentialed access, and accidental execution of write/destructive operations in the wrong context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.