ClawHub
Back to skill

Security audit

Serply

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only Serply connector, but its fallback setup instructs running unverified remote installer scripts, which deserves manual review before use.

Use this skill only if you trust OOMOL and Serply for the searches you ask it to run. Do not let an agent automatically run the curl-to-bash or PowerShell iex installer; install the oo CLI through a verified, trusted method and review what it will change on your machine first. Once the CLI is already installed and connected, the listed Serply actions are read-oriented.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installer Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–62
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from cli.oomol.com and execute the responses immediately using Bash or PowerShell. Neither command pins the installer to a specific version or immutable artifact. The instructions also provide no checksum validation, digital-signature verification, or opportunity to inspect the downloaded content before execution.

Although the remote domain is consistent with the stated OOMOL service, this does not eliminate the security risk. Compromise of the hosting infrastructure, CDN, DNS resolution, TLS termination, deployment account, or installer itself could cause arbitrary attacker-controlled commands to be returned and executed. PowerShell's iex presents the same underlying risk as piping a curl response into Bash.

This installation behavior is not necessary during ordinary Serply search operations. It is presented only as a first-time fallback when oo is unavailable, but it expands the trust and privilege boundary beyond the Skill's declared Bash(oo *) runtime access. The audit found no evidence that the currently hosted scripts are malicious; the vulnerability is the unverified and mutable remote-code execution mechanism.

Attack Path

  1. The user or agent attempts to use the Skill on a system where the oo CLI is not installed.
  2. Following the documented setup procedure, the user runs the Bash or PowerShell installation command.
  3. The command downloads a mutable script from cli.oomol.com.
  4. An attacker who has compromised the script, hosting account, delivery infrastructure, or relevant networ ...[truncated 1040 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the pipe-to-shell and iex instructions with installation through a trusted operating-system package manager where possible.
  2. Otherwise, link to a version-pinned release artifact hosted at an immutable location rather than a mutable generic installer URL.
  3. Publish a cryptographic checksum and a verifiable digital signature for every installer artifact.
  4. Require users to download the artifact to disk, verify its checksum and signature, and inspect it before execution.
  5. Document the installer's expected files, permission requirements, network connections, and system changes.
  6. Require explicit user approval before installation and prohibit agents from automatically executing setup commands.
  7. Run installation with ordinary user privileges unless a narrowly defined operation genuinely requires elevation.
  8. Prefer a command sequence such as download, signature verification, checksum verification, and explicit execution rather than directly connecting a network response to a command interpreter.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a curl | bash installation command that downloads and immediately executes a remote script without verification. If the remote host, transport, installer, or distribution pipeline is compromised, a user following these instructions could execute arbitrary code on their machine with the permissions of the current user.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description uses an expansive invocation condition that can match a wide range of tasks without clarifying scope, exclusions, or examples. This makes it unclear when the skill should be used versus when a different workflow would be more appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.