ClawHub
Back to skill

Security audit

Retable

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly scoped Retable connector, but users should be careful with its one-time CLI installer commands.

Install only if you are comfortable letting the oo CLI access your connected Retable account. Review write and delete payloads before approval, and prefer verifying or manually installing the oo CLI from OOMOL's official instructions rather than blindly running the pasted installer commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
94% confidence
Finding
The skill instructs the agent/user to install the CLI by piping a remotely fetched script directly into a shell (`curl ... | bash`). This bypasses integrity verification and gives the remote server full code-execution capability on the local system; if the install endpoint, transport, DNS, or hosting is compromised, arbitrary commands could run immediately. In this skill context, the danger is elevated because the content is operational guidance for an agent workflow, making it more likely to be executed as written during setup.

Static analysis

No suspicious patterns detected.