ClawHub
Back to skill

Security audit

Roam HQ

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly scoped to Roam HQ via OOMOL, but its setup instructions include unverified remote installer commands that can execute arbitrary code.

Review before installing. Use this only if you trust OOMOL and the oo CLI, and prefer a verified installer or checksum/signature workflow instead of running curl-to-bash or PowerShell iex. Confirm any send_message payload carefully because it can post to a Roam HQ group through the connected account.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: Critical

Vulnerable code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from an external server and immediately execute them using Bash or PowerShell. The downloaded content is not pinned to a specific release, saved for review, checked against an expected cryptographic hash, or verified using a digital signature.

HTTPS protects the script while it is in transit, but it does not establish that the current payload is the same payload that existed when this Skill was audited. Compromise of the vendor's hosting infrastructure, deployment process, domain, or signing account—or a malicious future modification by the provider—could cause these commands to execute arbitrary code.

Installation of the oo CLI may be necessary for the declared functionality, but direct pipe-to-shell execution exceeds the minimum safe installation privileges and removes an important inspection and verification boundary. The same issue affects both the macOS/Linux and Windows instructions.

The separately identified network behavior of oo connector run is consistent with the declared hosted Roam HQ connector functionality. The reviewed file contains no evidence that it reads unrelated local secrets or directly exposes raw authentication tokens.

Attack Path

  1. A user or Agent attempts to use the Skill on a system where the oo CLI is unavailable.
  2. The command fails with oo: command not found.
  3. Following the first-time setup instructions, the user or Agent invokes one of the remote installation commands.
  4. The current contents of install.sh or install.ps1 are retr ...[truncated 1373 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both direct pipe-to-shell installation patterns.
  2. Pin installation instructions to a specific, immutable oo CLI version rather than a mutable generic installer URL.
  3. Download the installer or release artifact to a local file without executing it automatically.
  4. Publish expected SHA-256 or stronger hashes through an independently protected channel and verify the downloaded artifact before execution.
  5. Prefer cryptographic release signatures and verify them against a documented, pinned vendor signing key.
  6. Allow the user to inspect the downloaded script and clearly disclose any filesystem, network, or privilege changes it will perform.
  7. Require explicit user approval before running an installer or requesting elevated privileges.
  8. Prefer an authenticated operating-system package manager or an official release artifact with reproducible provenance.
  9. Fail closed if verification is unavailable or unsuccessful; do not fall back to executing unverified content.
  10. Document the exact supported version, expected download origin, checksum/signature verification procedure, and uninstall process.

A safer general workflow is: download a versioned artifact, verify its signature and checksum, display the verified version and intended changes, obtain explicit approval, and only then execute or install it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into bash, which executes unverified code from the network without integrity checking. If the install server, transport path, or script content is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Roam HQ request" and "Whenever a task involves Roam HQ," which is an extremely broad activation condition. It does not define constraints, exclusions, or negative examples, so ordinary references to Roam HQ could trigger the skill unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.