ClawHub
Back to skill

Security audit

Roam SCIM

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing Roam SCIM, but its setup instructions tell users to run unverified remote installer scripts that could execute arbitrary local code.

Install only if you trust OOMOL and are comfortable using its oo CLI for Roam SCIM administration. Avoid running the documented pipe-to-shell installer commands as written; prefer a signed or checksum-verified installer, inspect downloaded scripts before execution, and do not approve write or destructive SCIM actions unless the payload and target are exactly what you intended.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding
Unverified Remote Shell Script Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 67 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a mutable remote response directly into Bash. The downloaded script is neither pinned to a specific release nor verified using a cryptographic signature or checksum before execution. HTTPS protects the connection in transit but does not mitigate compromise of the hosting infrastructure, publishing account, DNS, or installer itself. Because the effective executable content is controlled remotely and can change after the Skill has been audited, reviewers cannot establish that the command will continue to perform only the documented CLI installation. This execution capability exceeds the minimum privileges required to describe or invoke the Roam SCIM connector. ### Attack Path 1. A Roam SCIM operation fails because the `oo` command is unavailable. 2. The agent or user follows the documented first-time setup procedure. 3. `curl` retrieves the current content of `https://cli.oomol.com/install.sh`. 4. The response is passed directly to Bash without verification or inspection. 5. If the remote endpoint, publishing pipeline, or installer has been compromised, attacker-controlled commands execute with the invoking user's privileges. ### Impact Assessment A substituted installer can execute arbitrary commands under the user's account. It could read or modify accessible files, collect environment variables and local credentials, alter shell configuration, install additional software, or create persistence where the user's permissions allow it. If invoked from a privileged shell, the impact could extend to system-wide compromise. No evidence confirms that the current remote script is malicious; the vulnerability is the unverified remote execution mec ...[truncated 7 chars]
Remediation
## Remediation Suggestions - Do not pipe a network response directly into a shell. - Direct users to a version-pinned release hosted in a verified official repository. - Download the installer or package as a separate step. - Verify a publisher signature or a SHA-256 checksum obtained through an independently trusted channel. - Allow the downloaded content to be inspected before execution. - Prefer a trusted operating-system package manager with signed packages and repository metadata. - Run installation with ordinary user privileges unless elevated access is demonstrably required. - Document the files, permissions, and configuration changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:71
Finding
Unverified Remote PowerShell Script Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 71 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction retrieves a mutable PowerShell script using `Invoke-RestMethod` (`irm`) and immediately evaluates it using `Invoke-Expression` (`iex`). There is no release pinning, Authenticode validation, checksum verification, or opportunity to inspect the script before execution. `Invoke-Expression` treats the entire remote response as executable PowerShell. Consequently, compromise or replacement of the remotely hosted installer provides a direct arbitrary-code execution channel that can change after the Skill package has been reviewed. ### Attack Path 1. A Windows user or agent encounters an `oo: command not found` condition. 2. The documented first-time setup command is executed. 3. `Invoke-RestMethod` retrieves the current response from `https://cli.oomol.com/install.ps1`. 4. The response is passed directly to `Invoke-Expression`. 5. A compromised or substituted response executes immediately in the current PowerShell security context. ### Impact Assessment Attacker-controlled PowerShell would obtain the privileges of the invoking process. It could access user files and credentials, modify profiles or registry values, download additional payloads, or establish persistence where permissions permit. Execution from an elevated PowerShell session could enable system-wide changes. The reviewed file does not prove that the current installer is malicious; the confirmed risk is execution of unverified, remotely mutable code.
Remediation
## Remediation Suggestions - Remove the `irm ... | iex` installation pattern. - Publish and reference a version-pinned installer or signed package. - Download the script to disk before execution. - Require Authenticode signature validation and/or verification of a published cryptographic checksum. - Prefer a trusted Windows package manager backed by signed manifests and artifacts. - Execute installation without administrative privileges unless elevation is strictly necessary. - Clearly document expected filesystem, registry, environment, and network changes.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
97% confidence
Finding
The skill recommends installing software via a remote script piped directly into a shell, which executes network-fetched code without verification. If the install server, transport, or upstream script is compromised, users could run arbitrary attacker-controlled code on their machine.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The description instructs the agent to use this skill for ANY Roam SCIM request, which is overly broad and can cause the skill to be invoked whenever Roam SCIM is mentioned, even if a safer or more appropriate path exists. In a skill that includes state-changing and destructive operations, broad routing increases the chance of unintended execution paths and weakens contextual safety checks.

Static analysis

No suspicious patterns detected.