ClawHub
Back to skill

Security audit

Rocketlane

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Rocketlane read connector, but its setup instructions tell users to execute unverified remote installer scripts.

Review before installing. The Rocketlane actions shown are read-only, but do not run the remote installer commands unless you trust OOMOL's installer path; prefer a verified, pinned, or package-manager installation method if available, and confirm what Rocketlane data the OOMOL connection can access.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Installer Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from an external server and immediately execute them in Bash or PowerShell. The package does not pin an installer version, verify a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded content before execution.

HTTPS protects transport in normal conditions but does not establish that the script content is immutable or independently trusted. If the domain, hosting account, CDN, DNS path, TLS infrastructure, or installer publication process is compromised, the fetched script can be replaced with arbitrary commands. The effective payload is not included in the audited project and can change after review.

Installing the required CLI may support the Skill's declared functionality, but direct execution of an unverified remote response exceeds the minimum mechanism necessary for installation. A pinned and cryptographically verified release artifact would meet the same functional need with less risk.

Attack Path

  1. The oo command is unavailable and an operator or agent follows the first-time setup instructions.
  2. An attacker compromises or otherwise gains control over the remote installer delivery path.
  3. The attacker modifies install.sh or install.ps1 to include malicious commands.
  4. curl | bash or irm | iex executes the modified response immediately, without integrity validation.
  5. The payload runs with the privileges of the user launching the installation and can perform any operation available to that account.

Impact Assessment

Successful exploitation provides arbitrary co ...[truncated 642 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash and irm | iex installation patterns.
  2. Pin installation instructions to a specific CLI version rather than a mutable installer endpoint.
  3. Download the release artifact to a local file without executing it.
  4. Verify the artifact using a SHA-256 digest published through an independently protected channel or, preferably, a cryptographic signature whose trusted public key is distributed separately.
  5. Abort installation if verification fails.
  6. Allow the operator to inspect the downloaded installer or artifact before execution.
  7. Prefer signed packages distributed through trusted operating-system package repositories where available.
  8. Avoid requesting administrative privileges unless a specific installation step requires them, and document that requirement.
  9. Apply equivalent pinning and verification controls to both the Bash and PowerShell installation paths.
  10. If a bootstrap script remains necessary, vendor a reviewed version in the Skill package and verify all artifacts it subsequently retrieves.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest promises the skill is only for searching and reading data, but the body authorizes arbitrary Rocketlane actions and explicitly discusses possible write and destructive operations. This mismatch can mislead downstream agents or reviewers into granting the skill broader trust than intended, enabling unintended state changes in an external SaaS system.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs users to install software using a remote script piped directly into bash, which is a classic supply-chain risk. If the hosting endpoint, transport, or script content is compromised, arbitrary code will execute immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The safety section says only actions tagged [write] or [destructive] can change state, but the listed actions contain no such tags while earlier text authorizes arbitrary action names via the connector. That creates an unsafe assumption that unlisted or untagged actions are harmless, which could cause an agent to execute state-changing operations without the intended confirmation barrier.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.