ClawHub
Back to skill

Security audit

Scrape Creators

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using Scrape Creators through OOMOL, but its setup guidance includes direct remote script execution and its activation scope is too broad.

Review this before installing. The normal connector flow is understandable, but do not run the installer commands as written unless you separately trust and verify OOMOL's installer. Prefer an official, pinned, checksum-verified install path, and only use the skill when you actually want it to call Scrape Creators through OOMOL.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Installer Scripts Are Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions pipe content retrieved from cli.oomol.com directly into a command interpreter. The Unix command executes the HTTP response with Bash, while the Windows command executes it through PowerShell's Invoke-Expression.

Neither command pins a specific installer version nor verifies a cryptographic signature or checksum. Consequently, the effective code executed can change after the Skill has been reviewed. HTTPS protects data in transit under normal conditions but does not protect against a compromised hosting account, server, build pipeline, signing infrastructure, or legitimately published but maliciously altered installer.

Installation is only presented as a fallback when oo is unavailable, so this behavior is not part of routine connector operation. Nevertheless, following the documented fallback grants a remotely controlled script the full privileges of the invoking user. This exceeds the minimum privileges required merely to describe or invoke the connector.

The audit did not independently confirm that connector requests exfiltrate unrelated sensitive information. Sending user-supplied connector input to OOMOL and Scrape Creators is disclosed and inherent to the declared remote scraping functionality. The file does not instruct the Agent to collect raw credentials, private keys, environment variables, or unrelated local files.

Attack Path

  1. The Agent attempts to invoke oo, but the command is not installed.
  2. Following the Skill's first-time setup instructions, the Agent or user runs one of the remote installation commands.
  3. The com ...[truncated 1342 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove direct curl | bash and Invoke-Expression installation patterns.
  2. Direct users to a trusted, version-pinned package manager entry or a specific signed release artifact.
  3. Download the installer to a local file rather than executing the network response immediately.
  4. Publish an expected SHA-256 digest and verify it before execution. Prefer cryptographic signature verification using a trusted, separately distributed public key.
  5. Display or inspect the downloaded script and obtain explicit user approval before executing it.
  6. Pin both the installer and CLI version so the reviewed payload cannot change silently.
  7. Run installation with ordinary user privileges wherever possible and clearly warn users not to use an elevated shell unless a documented step strictly requires it.
  8. Apply equivalent verification controls to both the Bash and PowerShell installation paths.
  9. Keep installation outside autonomous Skill execution: if the CLI is absent, report the condition and provide verified manual setup instructions rather than automatically executing an installer.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to execute a remote installation script via curl -fsSL https://cli.oomol.com/install.sh | bash, which pipes network-fetched content directly into a shell without integrity verification, review, or pinning. If the host, transport chain, or script is compromised, this can lead to arbitrary code execution on the user's machine; because it appears in a setup flow inside the skill, users may follow it with elevated trust.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger text is overly broad: "Use this skill for ANY Scrape Creators request" and "Whenever a task involves Scrape Creators, use this skill" can cause the agent to invoke the skill whenever the service is merely mentioned, rather than only when the user explicitly wants connector-backed actions. This increases the chance of unintended tool use and can route benign discussion or analysis into external API/CLI execution paths without sufficient user intent verification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.