ClawHub
Back to skill

Security audit

sevdesk

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing sevdesk contacts, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the installer source before running it, prefer a pinned or verified oo CLI installation method, and confirm exact payloads before allowing create, update, or delete contact actions in sevdesk.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Installer Download and Immediate Shell Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote mutable payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe installer content retrieved from remote URLs directly into Bash or PowerShell. The effective code executed on the user's system is not included in the reviewed Skill package and can change after this audit.

Neither installation command pins an installer version nor validates a cryptographic signature or checksum. The downloaded content is also not saved for inspection before execution. Consequently, compromise of the OOMOL distribution infrastructure, its DNS or hosting account, or the installer publication process could cause arbitrary attacker-controlled commands to execute.

Installing the CLI is relevant when the required oo command is absent, but immediate execution of an unverified, mutable response is not the minimum-risk installation mechanism. Trust in the HTTPS domain alone does not provide artifact-level provenance or protect against a compromised upstream publisher. The audit did not establish that the current endpoint is malicious; the vulnerability is the unsafe execution mechanism.

Attack Path

  1. The user or agent attempts to invoke oo and receives an oo: command not found error.
  2. The Skill directs the user or agent to one of the remote installation commands.
  3. An attacker compromises or gains control over the installer endpoint, publication pipeline, hosting account, or another trusted delivery component.
  4. The endpoint supplies a modified shell or PowerShell script.
  5. bash or iex executes the response immediately, without artifact inspection, version pinning, checksum va ...[truncated 985 chars]
Remediation
View remediation

Remediation Suggestions

Replace both pipe-to-shell installation instructions with a verifiable installation process:

  1. Link to a specific, immutable CLI release rather than a mutable installer endpoint.
  2. Pin the expected CLI version and download the artifact to a local file.
  3. Publish SHA-256 checksums through an independently protected release channel and verify the downloaded artifact before execution.
  4. Prefer cryptographic release signatures and verify them against a documented, pinned publisher key.
  5. Allow the user to inspect the downloaded installer before explicitly executing it.
  6. Prefer a trusted operating-system package manager where packages are signed and versioned.
  7. Do not request administrator privileges unless a documented installation step strictly requires them.
  8. Document the artifact source, expected signer, destination paths, files created, and permissions required.
  9. Abort installation on any verification failure rather than falling back to unverified execution.

A safer conceptual flow is:

bash
curl -fL --output oo-installer.sh "https://trusted.example/releases/v1.0.3/install.sh"
echo "EXPECTED_SHA256  oo-installer.sh" | sha256sum --check -
less oo-installer.sh
bash oo-installer.sh

The actual release URL and checksum must come from the official publisher and must be pinned to the intended release.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill recommends installing software via curl ... | bash, which executes a remote script immediately without integrity verification, review, or pinning. If the remote host, transport chain, or script content is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY sevdesk request" and "Whenever a task involves sevdesk," which is an extremely broad activation condition. For a markdown skill description, this lacks scope boundaries or exclusion examples and could cause unintended invocation for loosely related mentions of sevdesk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.