ClawHub
Back to skill

Security audit

Shopify Storefront

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for using Shopify Storefront through OOMOL, but its setup instructions include unverified remote installer commands that can execute changing code on the user's machine.

Review the OOMOL CLI installation path before installing. Do not let an agent automatically run the curl/PowerShell pipe-to-shell commands; prefer a verified installer, package manager, checksum or signature validation, and explicit user approval before executing any downloaded installer.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62 and 66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions retrieve mutable scripts from cli.oomol.com and immediately execute them through Bash or PowerShell. The downloaded content is not pinned to a specific version, saved for inspection, or validated using a cryptographic signature or expected checksum.

Although the installation host is associated with the declared OOMOL service and installation is only recommended after an oo: command not found error, the execution pattern creates a remote code-execution channel whose effective payload can change after the Skill has been reviewed. Compromise of the vendor's domain, DNS, CDN, hosting infrastructure, or software-release pipeline could therefore turn a legitimate setup operation into arbitrary local code execution.

This installation mechanism exceeds the minimum privileges necessary to document or invoke the Shopify connector. The Skill could instead direct users to a verified, version-pinned package or require a separate, explicit installation workflow.

Attack Path

  1. An attacker compromises the remote installer, its hosting infrastructure, the vendor's release pipeline, or another delivery component.
  2. The oo command is unavailable on the target system.
  3. Following the Skill's first-time setup guidance, the user or Agent runs the applicable installation command.
  4. curl or irm retrieves the attacker's modified script.
  5. The shell executes the response immediately, without integrity verification or an opportunity for review.
  6. The script performs arbitrary actions using the privileges of the invoking account.

Impact Assessment

...[truncated 725 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove both pipe-to-shell installation commands from the Skill instructions.
  2. Direct users to a trusted package manager or an official release artifact pinned to a specific version.
  3. Download the installer or binary to disk without executing it immediately.
  4. Publish and require verification of a cryptographic signature and a pinned SHA-256 or stronger checksum.
  5. Keep verification metadata on an independently protected channel rather than serving the artifact and checksum from the same mutable location.
  6. Allow the user to inspect the downloaded content before granting execution approval.
  7. Run installation with standard-user privileges unless a narrowly identified operation requires elevation.
  8. Document the files, directories, network endpoints, and permissions affected by installation.
  9. Require separate, explicit user confirmation before executing any installer; an Agent should not automatically install software after a connector command fails.
  10. Prefer a command pattern equivalent to:
bash
curl -fSLo oo-installer.sh "https://trusted.example/releases/<pinned-version>/install.sh"
echo "<pinned-sha256>  oo-installer.sh" | sha256sum --check -
# Inspect the verified script and obtain explicit approval before execution.
bash oo-installer.sh

Equivalent signature and hash verification should be required for the Windows installer.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into bash, which executes unverified code from the network without an integrity check or review step. If the host, CDN, transport path, or publishing pipeline were compromised, this could lead to arbitrary code execution on the user's machine; because this is a setup path for the skill, the context makes the risk more dangerous by normalizing unsafe execution as part of expected use.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Static analysis

No suspicious patterns detected.