ClawHub
Back to skill

Security audit

Sendlane

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Sendlane connector, but its setup instructions tell the agent to execute a mutable remote installer directly, which needs user review before installation.

Install only after reviewing the official oo CLI source and using a safer verified installation path where possible. Before allowing this skill to run, make sure you understand that it can create, update, and delete Sendlane objects through your connected account, and require explicit confirmation for every write or destructive action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:70
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70–74
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions download scripts from an external server and immediately execute their contents through bash or PowerShell's Invoke-Expression. The retrieved payload is not pinned to a specific release, inspected before execution, or verified using a cryptographic checksum or publisher signature.

Consequently, the effective code executed by this Skill can change after the reviewed SKILL.md file has been published. Compromise of the hosting domain, DNS or TLS infrastructure, server account, release pipeline, or installer itself could convert these commands into an arbitrary-code execution mechanism.

Installing the required CLI is relevant to the declared Sendlane connector functionality. However, immediate execution of an unverified, mutable remote response exceeds the minimum privileges and trust required for installation. The same weakness exists on both supported platform families.

Attack Path

  1. The oo CLI is unavailable, causing the first-time setup instructions to apply.
  2. An attacker compromises the remote installer, its hosting infrastructure, or the associated delivery pipeline.
  3. The response from https://cli.oomol.com/install.sh or https://cli.oomol.com/install.ps1 is replaced with attacker-controlled code.
  4. The installation command downloads the modified response.
  5. The pipe to bash or iex executes the response immediately without integrity or authenticity verification.
  6. The payload runs with the permissions of the user or agent process invoking the installation command.

Impact Assessm

...[truncated 638 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not pipe downloaded content directly into a shell or Invoke-Expression.
  2. Prefer an official operating-system package manager or a signed, versioned release artifact from a verifiable publisher.
  3. Pin the CLI to a specific reviewed version rather than retrieving a mutable installer.
  4. Download the installer to a local file without executing it.
  5. Verify a publisher signature and a pinned SHA-256 or stronger cryptographic digest before execution.
  6. Present the source, version, destination, expected file changes, and required permissions to the user.
  7. Obtain explicit user approval before executing any installer.
  8. Run installation with ordinary user privileges unless a documented step strictly requires elevation.
  9. Publish reproducible installer sources and document expected installed files so users can independently verify the package.
  10. Abort installation on redirects to unexpected domains, signature failures, checksum mismatches, or TLS errors.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly from the network without prior verification. If the remote host, distribution channel, or TLS trust path is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says to use this skill for "ANY Sendlane request" and "Whenever a task involves Sendlane," which is an extremely broad activation condition. It does not provide constraints, exclusions, or negative examples, so the trigger scope is ambiguous and may cause unintended invocation for loosely related Sendlane tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.