ClawHub
Back to skill

Security audit

Sherpa

Security checks for vulnerabilities and agentic risk

Overview

This Sherpa connector skill is mostly coherent, but its first-time setup tells users to run unverified remote install scripts that could execute arbitrary code if the delivery source were compromised.

Before installing, use this skill only for Sherpa read lookups and avoid running the pasted remote install commands unless you independently trust the OOMOL CLI installer. Prefer a signed or package-manager install path, verify the installer where possible, and do not run setup from an elevated shell unless you have a specific reason.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:56
Finding

Unverified Remote Shell Script Execution via curl and Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 56
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The first-time setup instructions pipe a remotely retrieved shell script directly into Bash. The payload is not pinned to an immutable version, downloaded for inspection, or validated using a cryptographic signature or trusted checksum before execution.

HTTPS protects the connection in transit but does not establish the long-term integrity of mutable content served by the endpoint. Compromise of the hosting service, publisher account, DNS or delivery infrastructure, or release process could cause the same documented command to execute attacker-controlled code after the Skill has already been reviewed.

Installing the required CLI is relevant to the declared functionality, but executing an unverified network response is not a least-risk installation mechanism. The remote script runs with all permissions available to the user who invokes the command.

Attack Path

  1. A Sherpa operation fails because the oo CLI is unavailable.
  2. The user or agent follows the documented first-time setup fallback.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The pipeline sends the response directly to Bash without an integrity check or review boundary.
  5. If the endpoint or delivery chain has been compromised, Bash executes attacker-controlled commands as the invoking user.
  6. Those commands may access user-readable information, modify files and shell configuration, install additional payloads, or establish persistence subject to the user's permissions.

Impact Assessment

Successful exploitation provides arbitrary command execution with the invoking user's privileges. The accessible scope may include project files, user documents, environment data, CLI configuration, authenti ...[truncated 249 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Prefer a trusted platform package manager or a signed, versioned installer published through an official distribution channel.
  • Pin installation artifacts to an explicit release version rather than a mutable URL.
  • Download the artifact to disk before execution so that retrieval and execution are separate operations.
  • Publish and require verification of a cryptographic signature from a documented release key.
  • If signatures are unavailable, publish a release-specific SHA-256 checksum over an authenticated channel and verify it before installation.
  • Document the files, directories, and permissions required by the installer.
  • Advise users to install under an unprivileged account and avoid sudo unless a specific operation has been justified.
  • Fail closed when signature or checksum verification does not succeed.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote PowerShell Execution via Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows installation instruction uses Invoke-RestMethod (irm) to retrieve mutable PowerShell source and pipes the result directly to Invoke-Expression (iex). This evaluates the network response as local code without pinning a release, validating an Authenticode signature, checking a trusted cryptographic hash, or allowing inspection before execution.

The effective payload can therefore change independently of the reviewed Skill file. HTTPS alone does not mitigate compromise of the publisher, endpoint, or software delivery process. Although installing the CLI supports the Skill's operation, direct evaluation of an unverified remote response exceeds the minimum privileges and trust necessary for setup.

Attack Path

  1. A Sherpa operation fails because the oo CLI is unavailable on Windows.
  2. The user or agent follows the documented PowerShell setup command.
  3. Invoke-RestMethod downloads the current contents of install.ps1.
  4. The pipeline passes that response directly to Invoke-Expression.
  5. If an attacker controls or compromises the delivered content, PowerShell evaluates the attacker's commands with the invoking user's privileges.
  6. The payload may read accessible data, alter PowerShell profiles or application configuration, install additional software, or create persistence where the account has permission.

Impact Assessment

Successful exploitation results in arbitrary PowerShell execution as the invoking user. This can expose user-accessible documents, project data, environment information, application configuration, and authentication material available to that account. It can also permit modification of writable system or user settings and installation of fo ...[truncated 165 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex download-and-execute pattern.
  • Distribute the CLI through a trusted Windows package manager or a signed, versioned installer.
  • Pin the package or installer to a specific release.
  • Download the installer separately and verify its Authenticode signature against the expected publisher before execution.
  • Publish a release-specific SHA-256 checksum through an authenticated channel and verify it in addition to the publisher signature.
  • Do not use Invoke-Expression for content obtained from the network.
  • Clearly document expected installation changes and whether administrative rights are required.
  • Default to a non-administrator installation where feasible.
  • Abort installation if publisher identity, signature validity, release version, or checksum validation fails.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install the CLI via a piped remote script (curl ... | bash), which executes code fetched at runtime without verification. If the remote host, CDN, DNS, TLS trust chain, or install script is compromised, this becomes arbitrary code execution on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for 'ANY Sherpa request,' which is an overly broad invocation trigger. Broad matching can cause the agent to select this skill in unintended contexts and execute external connector/CLI actions when a narrower tool or direct user clarification would be safer.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.