ClawHub
Back to skill

Security audit

Route4Me

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing Route4Me through OOMOL, but its setup instructions tell users to execute unverified remote installer scripts.

Review the setup path before installing. Prefer installing the oo CLI from a verified package or staged download with checksum or signature validation, and confirm exact payloads before any Route4Me create or delete action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Installer Download and Immediate Shell Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The first-time setup instructions download mutable scripts from an external service and execute them immediately:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands combine remote retrieval with immediate code execution. The downloaded content is not pinned to a specific release and is not validated using a cryptographic signature or published checksum before execution. The user or agent therefore cannot verify that the executed script is the same artifact that was security-reviewed.

TLS protects data in transit but does not mitigate compromise of the hosting domain, DNS infrastructure, web server, release pipeline, or installer source. Any party able to alter the response from either URL can supply arbitrary shell or PowerShell commands.

Installing the CLI is relevant only when it is absent, but executing an unverified remote script is not the minimum privilege or minimum-risk method necessary to perform that installation. A pinned and independently verified package could provide the same functionality without directly executing mutable network content.

Attack Path

  1. An action fails because the oo command is unavailable.
  2. The agent or user follows the documented first-time setup procedure.
  3. An attacker compromises the installer host, deployment pipeline, DNS path, or another component capable of changing the installer response.
  4. The command downloads the attacker's substituted script.
  5. The shell or PowerShell interpreter executes the response immediately, without inspection or integrity verification.
  6. The malicious installer performs arbitrary actions under the privilege ...[truncated 868 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash and irm | iex installation patterns.
  2. Direct users to a pinned release or trusted platform package manager rather than a mutable installer endpoint.
  3. Download the installer or package as a separate step and do not execute it automatically.
  4. Publish a SHA-256 checksum and, preferably, a cryptographic signature for every release.
  5. Verify the checksum and signature against metadata obtained through an independent trusted channel before execution.
  6. Pin the expected CLI version so reviewed behavior cannot change silently.
  7. Display the artifact location and require explicit user approval before running any installer.
  8. Run installation with ordinary user privileges unless a specific, documented operation requires elevation.
  9. Document the files, directories, network endpoints, and configuration changes used by the installer.
  10. Prefer commands similar to the following staged process:
bash
curl -fSLo oo-installer.sh https://trusted.example/releases/vX.Y.Z/install.sh
echo '<published-sha256>  oo-installer.sh' | sha256sum --check
# Inspect the downloaded script and obtain explicit approval before execution.
bash oo-installer.sh

Equivalent PowerShell instructions should use a pinned artifact, validate its Authenticode signature or published cryptographic hash, and obtain approval before invoking it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill recommends installing software via curl ... | bash, which executes remote script content directly without prior verification. If the hosting endpoint, network path, or distribution process is compromised, users could run arbitrary code on their machine, making this especially dangerous in a skill that may be followed operationally by an agent or user.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY Route4Me request" and "Whenever a task involves Route4Me," which is extremely broad and lacks boundaries or exclusion conditions. In a markdown skill file, this can create ambiguous triggering because it does not specify narrower contexts, examples, or when the skill should not be invoked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.