ClawHub
Back to skill

Security audit

SellerSpace

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent read-only SellerSpace connector, but its first-time setup tells users to execute unverified remote installer scripts.

Review this skill before installing if you are uncomfortable with remote installer scripts. Prefer installing the oo CLI from verified official documentation or a pinned, checksum-verified release, and only run login or SellerSpace connection setup when you explicitly intend to connect that account.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote Shell Script Execution on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and pipes the response directly into Bash. There is no pinned release, cryptographic signature verification, checksum validation, or opportunity to inspect the downloaded artifact before execution.

Although HTTPS protects the network connection in transit, it does not mitigate compromise of the hosting server, publishing account, DNS infrastructure, or upstream release process. Because the external response can change after the Skill has been reviewed, the command creates a remote code-execution channel whose effective payload is not contained in the audited project.

Installation is only suggested when the oo command is unavailable, but installing arbitrary remotely supplied code is not the minimum privilege necessary to document or perform SellerSpace read operations.

Attack Path

  1. A user or Agent attempts to perform a SellerSpace operation.
  2. The oo CLI is not installed.
  3. The Skill directs the user or Agent to run the installation pipeline.
  4. An attacker compromises or otherwise gains control over the script returned by https://cli.oomol.com/install.sh.
  5. curl retrieves the attacker-controlled response.
  6. The pipe sends that response directly to Bash without verification.
  7. The payload executes with the privileges of the invoking account.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's privileges. The payload could access readable files and environment variables, steal locally available credentials, modify user data, install additional software, establish persistence, or alter the Agent en ...[truncated 288 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pipeline.
  • Prefer an official operating-system package manager with a pinned package version and verified publisher metadata.
  • If manual installation is required, download a versioned release artifact to a local file rather than executing a live response.
  • Pin the expected release version and verify a cryptographic publisher signature.
  • Publish a trusted SHA-256 checksum through an independent, authenticated release channel and compare it before execution.
  • Allow the user to inspect the downloaded script or artifact before running it.
  • Require an explicit, user-initiated installation decision rather than allowing an Agent to install the CLI automatically.
  • Run installation with ordinary user privileges unless a narrowly defined operation demonstrably requires elevation.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding

Unverified Remote PowerShell Script Execution on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 67
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows installation instruction retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and immediately evaluates the response with Invoke-Expression (iex). The command does not pin a release or verify a checksum, Authenticode signature, or other publisher identity before execution.

The contents served by the external endpoint can change independently of the audited Skill. A compromise of the hosting service, publishing account, DNS infrastructure, or upstream distribution process could therefore turn this setup instruction into arbitrary PowerShell execution. HTTPS alone does not establish that the retrieved script is the reviewed or intended version.

The ability to execute an unrestricted external PowerShell response exceeds the permissions required for the Skill's declared read-only SellerSpace connector functionality.

Attack Path

  1. A user or Agent attempts to use SellerSpace on a Windows system.
  2. The oo CLI is unavailable.
  3. The Skill presents the PowerShell installation command.
  4. An attacker causes https://cli.oomol.com/install.ps1 to return attacker-controlled PowerShell.
  5. irm downloads the response into the PowerShell pipeline.
  6. iex interprets and executes the response without integrity or signature validation.
  7. The payload runs with the security context of the PowerShell process.

Impact Assessment

Successful exploitation provides arbitrary PowerShell execution with the invoking user's privileges. The payload could read accessible files and environment variables, exfiltrate credentials available to that account, modify user or application data, download additional payloads, or establ ...[truncated 253 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pipeline.
  • Distribute the CLI through a trusted Windows package manager or a versioned installer with verified publisher signatures.
  • Download the installer or script to disk as a separate step.
  • Pin an audited release and validate its Authenticode signature and a published cryptographic checksum before execution.
  • Reject unsigned artifacts, invalid signatures, checksum mismatches, redirects to unexpected hosts, and unapproved versions.
  • Let the user inspect the downloaded script before manually invoking it.
  • Keep installation explicitly user-controlled and avoid automatic elevation.
  • Document the exact files, permissions, and system changes the installer requires.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via a remote script piped directly into a shell (curl ... | bash), which executes code from the network without verification. If the distribution endpoint, transport, or upstream release process were compromised, this could lead to arbitrary code execution on the host running the command.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says to use this skill for "ANY SellerSpace request," which is a very broad activation condition and does not define clear limits or exclusions. This can overlap with many ordinary requests mentioning SellerSpace and may cause unintended invocation instead of more specific routing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.