ClawHub
Back to skill

Security audit

screenshotbase

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a normal Screenshotbase connector, but its setup guidance includes unsafe remote script execution and its screenshot action is under-labeled as a safe read.

Review this before installing. Prefer installing the oo CLI through a verified, pinned, or signed method instead of running the provided pipe-to-shell commands. Treat take_screenshot as an external capture action: only use it for URLs you intend to send to Screenshotbase, and avoid sensitive, authenticated, private, or internal pages unless you have explicit authorization.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:56
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 56
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a remotely retrieved script directly into bash. The script is not version-pinned, inspected, or verified using a cryptographic signature or checksum before execution. Consequently, the effective executable payload can change after the Skill package has been reviewed.

HTTPS provides transport protection but does not guarantee that the hosting service, publication account, DNS path, or future installer content will remain trustworthy. If any of those components is compromised, arbitrary commands supplied by the remote party will be executed with the privileges of the user running the Skill.

Installing the CLI may be necessary for the declared Screenshotbase integration, but immediate execution of mutable network content exceeds the minimum privilege and trust required to provide installation guidance.

Attack Path

  1. A Screenshotbase operation fails because the oo CLI is not installed.
  2. The Agent or user follows the first-time setup instructions in SKILL.md.
  3. curl downloads the current response from https://cli.oomol.com/install.sh.
  4. The response is passed directly to bash without local review or integrity verification.
  5. If the remote script or its delivery infrastructure has been compromised, attacker-controlled shell commands execute under the invoking user's account.
  6. Those commands can modify files, read accessible data, install additional software, or establish persistence, subject to the invoking user's permissions.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user invoking bash. This can expose user-readable credentials and files, alt ...[truncated 332 chars]

Remediation
View remediation

Remediation Suggestions

Remove the direct curl | bash execution pattern. Direct users to an official, version-pinned release and require the installer to be downloaded as a separate file before execution. Publish a cryptographic signature or trusted SHA-256 checksum and verify it locally before running the installer.

Prefer installation through a reputable operating-system package manager with a pinned package version and signed repository metadata. If a shell installer remains necessary, document its expected permissions and filesystem changes, provide a review step, and run it without elevated privileges unless a specific operation demonstrably requires elevation.

A safer workflow should follow this sequence:

  1. Download a version-pinned installer from an official release.
  2. Verify its signature or checksum against independently published metadata.
  3. Review or display the script before execution.
  4. Execute it with the least-privileged account needed.
  5. Record the installed version and provide removal instructions.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows installation instruction retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and immediately executes the response with Invoke-Expression (iex). No fixed release version, checksum, digital-signature validation, or user inspection step is required.

Invoke-Expression treats the downloaded response as executable PowerShell code. A compromise of the hosting service, publication credentials, or delivery infrastructure would therefore create a direct remote-code-execution path. The payload can also change independently of the audited SKILL.md, preventing the Skill review from establishing what commands will ultimately run.

Installation of the declared CLI may be legitimate, but executing an unverified network response is not the least-privileged or least-trust method of satisfying that dependency.

Attack Path

  1. A Screenshotbase operation fails because the oo CLI is unavailable on Windows.
  2. The Agent or user follows the PowerShell setup command.
  3. Invoke-RestMethod retrieves the current content of https://cli.oomol.com/install.ps1.
  4. The response is sent directly to Invoke-Expression.
  5. A malicious or compromised response executes as PowerShell code under the current security context.
  6. The payload can access available files and credentials, change user configuration, retrieve secondary payloads, or attempt privilege elevation and persistence.

Impact Assessment

Exploitation yields arbitrary PowerShell execution with the invoking user's privileges. Potential consequences include disclosure or modification of user-accessible data, credential theft, installation of additional payloads, and alteration o ...[truncated 283 chars]

Remediation
View remediation

Remediation Suggestions

Remove the irm | iex pattern. Provide a version-pinned, digitally signed installer or package and instruct users to save it locally before execution. Validate its Authenticode signature and a cryptographic checksum obtained from independently published release metadata.

Prefer a signed package delivered through a trusted Windows package manager. If PowerShell installation is unavoidable:

  1. Download the script to a local file without executing it.
  2. Pin the installer to a specific reviewed release.
  3. Verify its Authenticode signature and SHA-256 checksum.
  4. Present the script for inspection.
  5. Execute it without administrator privileges unless elevation is demonstrably necessary.
  6. Document all expected changes and provide rollback instructions.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly without verification. If the install endpoint, transport, or hosting is compromised, this becomes an immediate remote code execution path on the user's machine; placing it in a fallback section of the skill makes the dangerous pattern easy to propagate operationally.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata says it is for 'searching and reading data,' but the documented capability includes taking screenshots of arbitrary webpages, which is an active operation rather than a simple read. This mismatch can cause users or downstream agents to authorize or invoke the skill under a lower-risk mental model, increasing the chance of unintended access to internal-only URLs or sensitive web content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to use this skill for 'ANY screenshotbase request' is overly broad and may cause automatic invocation whenever screenshot-related terms appear, even when the task does not require this connector. Broad routing language increases the risk of accidental tool use, bypass of more appropriate safeguards, or sending user-controlled targets to a screenshot service without deliberate review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The safety section states that untagged actions are reads and safe to run directly, but take_screenshot is untagged despite causing an external side effect and potentially accessing arbitrary URLs. This misclassification weakens operator caution and can lead to blind screenshotting of attacker-controlled, internal, or sensitive pages without the scrutiny expected for non-read actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.