ClawHub
Back to skill

Security audit

Shopify REST Admin (Legacy)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a read-only Shopify connector, but its first-time setup tells users to execute an unverified remote installer directly in the shell.

Install only if you are comfortable trusting OOMOL's CLI installer and Shopify connector. Prefer installing the oo CLI through a verified, versioned, or checksum-validated method instead of piping remote scripts directly into bash or PowerShell, and use the skill only for the listed read-only Shopify actions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote Installer Is Piped Directly into Command Interpreters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–72
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

markdown
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  ```

Technical Analysis

The installation instructions download mutable content from cli.oomol.com and pass the response directly to Bash or PowerShell. Neither installation path pins a release, verifies a cryptographic signature or checksum, nor provides an opportunity to inspect the downloaded code before execution.

HTTPS protects the connection in transit under normal conditions, but it does not establish that the current remote script is the same payload that was reviewed. Compromise of the distribution server, publishing account, certificate trust path, or installer deployment process could therefore turn this documented setup step into arbitrary code execution.

The installer runs with the privileges of the invoking user and may gain greater privileges if it requests elevation and the user approves it. This exceeds the minimum privilege required for a read-only Shopify connector skill: the skill only needs access to an already installed oo CLI, while installing mutable remote code creates a separate system-wide trust boundary.

Attack Path

  1. The oo command is absent, causing the user or agent to follow the first-time setup instructions.
  2. An attacker compromises or otherwise gains control over the installer response served from cli.oomol.com.
  3. The victim runs the documented curl ... | bash or irm ... | iex command.
  4. The shell executes the attacker-controlled response immediately, without inte ...[truncated 1175 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both direct execution pipelines. Never pass an uninspected network response directly to Bash or PowerShell.
  2. Prefer a trusted operating-system package manager or a signed vendor package with a version pinned in the instructions.
  3. If a standalone installer is unavoidable:
    • Download it to a local file without executing it.
    • Pin the expected installer or release version.
    • Obtain the checksum or signature through an independently authenticated channel.
    • Verify a SHA-256 checksum and, preferably, a vendor cryptographic signature.
    • Abort installation if verification fails.
    • Allow the user to inspect the file before execution.
    • Execute it only after explicit user approval.
  4. Publish immutable, versioned installer URLs rather than mutable install.sh and install.ps1 endpoints.
  5. Document the files, directories, network destinations, and privilege level required by installation.
  6. Ensure installation defaults to the current user's scope and does not request administrator or root privileges unless a clearly identified operation requires them.
  7. Keep the existing behavior that installation occurs only after a genuine command not found failure, but require user confirmation before beginning any installation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a curl ... | bash installation command that downloads and immediately executes remote code without integrity verification. If the distribution endpoint, transport, or upstream content is compromised, an operator could execute attacker-controlled code on the host, leading to full local compromise and credential theft.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description instructs the agent to use this skill for ANY Shopify REST Admin request, which is broader than the actual documented capability of searching and reading data. Over-broad routing can cause the agent to invoke this skill when another interface or narrower permission boundary would be more appropriate, increasing the chance of unintended data access or operational mistakes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The title hard-codes "Shopify REST Admin (Legacy)," which is not itself a locale issue, but there is no visible language or locale constraint elsewhere. No actionable policy violation is present here after review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation says actions that change state are tagged with [write] or [destructive] and includes safety rules for such actions, but the enumerated action list only contains count/get/list operations and shows no write or destructive entries. This creates an intent/documentation contradiction about the actual capabilities exposed by the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.