ClawHub
Back to skill

Security audit

ScrapeGraphAI

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its ScrapeGraphAI purpose, but its setup instructions tell users or agents to run unverified remote installer scripts directly.

Review the setup path carefully before installing. Use this skill only if you are comfortable with OOMOL mediating ScrapeGraphAI access and avoid letting an agent run the remote installer commands automatically; prefer official, version-pinned, signed, or checksum-verified installation steps where available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions retrieve mutable scripts from an external server and pass them directly to Bash or PowerShell. Neither command pins an installer version, validates a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded content before execution.

Consequently, the code that ultimately runs is not contained in the audited Skill and can change after review. Although the download domain is consistent with the declared OOMOL integration and the instructions only recommend installation after a command-not-found error, direct remote-script execution exceeds the minimum privilege necessary to provide installation guidance.

The project does not contain evidence that the current remote installers are malicious. The vulnerability arises from delegating local code execution to mutable, unverified network content.

Attack Path

  1. The user or agent attempts to invoke oo and receives an oo: command not found error.
  2. The agent follows the first-time setup instructions in SKILL.md.
  3. The installation script is retrieved from cli.oomol.com.
  4. An attacker who has compromised the hosting service, its deployment pipeline, or the relevant network trust path supplies modified script content.
  5. The shell executes that content immediately, without integrity validation or inspection.
  6. The payload can perform any operation permitted to the account running Bash or PowerShell.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the invoking user. Depending on those privileges a ...[truncated 824 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash and irm | iex installation patterns.
  2. Direct users to a version-pinned release artifact or a trusted platform package manager instead of executing a mutable installer endpoint.
  3. Require the installer to be downloaded as a file before execution.
  4. Publish an expected SHA-256 or stronger checksum through an independently protected release channel and verify it before running the artifact.
  5. Prefer signed packages and enforce signature verification against a documented publisher key.
  6. Require explicit user approval before installing software; the agent should not perform installation automatically after a failed command.
  7. Encourage execution without administrator or root privileges unless a documented installation step strictly requires elevation.
  8. If script-based installation remains necessary, pin an immutable installer version, display the exact source and destination to the user, and provide separate download, verification, inspection, and execution commands.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software via curl ... | bash, which executes a remote script directly without verification. If the remote server, network path, or hosting account is compromised, arbitrary code could be executed on the user's machine, making this especially dangerous in a skill that may be followed operationally by an automated agent or a trusting user.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction to use this skill for 'ANY ScrapeGraphAI request' is overly broad and can cause the agent to invoke the skill in situations where a narrower or safer path would be more appropriate. Broad activation language increases the chance of unintended tool use on user-supplied content or ambiguous requests, which can expand exposure to downstream connector actions and setup flows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest narrows the skill's purpose to 'searching and reading data,' which implies retrieval-focused use. However, the documented available actions include extract, which performs transformation/extraction on URLs, HTML, or markdown, and account-oriented actions like get_credits, get_history, and list_history, which go beyond the plain-language description of searching and reading data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.