ClawHub
Back to skill

Security audit

Short.io

Security checks for vulnerabilities and agentic risk

Overview

The Short.io skill is mostly coherent, but its setup instructions ask users to run remote installer scripts directly, which warrants careful review before use.

Review the installer source and prefer a pinned, signed, or checksum-verified oo CLI installation path before installing. After setup, check payloads carefully before approving Short.io create, update, or delete actions because they can change account data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote Installer Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from external OOMOL endpoints and immediately execute them using Bash or PowerShell. No version pinning, cryptographic signature validation, checksum verification, local inspection, or other integrity control is required before execution.

HTTPS protects the connection in transit but does not establish that the downloaded script is a specific audited version. If the hosting infrastructure, DNS, deployment pipeline, TLS trust chain, or publisher account is compromised, the remote response can be replaced after this skill has been reviewed. The resulting payload will execute with all permissions available to the user running the command.

Installing the oo CLI supports the skill's declared Short.io functionality, but piping mutable network content directly into a shell is not the minimum privilege or minimum-risk installation method necessary to provide that functionality. The remote installer itself is not included in the project, so its effective behavior and any permissions it requests cannot be established from the audited artifact.

Attack Path

  1. The oo CLI is absent, and an action fails with an oo: command not found error.
  2. A user or agent follows the documented first-time setup instructions.
  3. The command requests install.sh or install.ps1 from the external OOMOL server.
  4. An attacker who has compromised the distribution endpoint or another relevant supply-chain component substitutes malicious script content.
  5. Bash or PowerShell executes the response immediately, withou ...[truncated 1189 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace pipe-to-shell and Invoke-Expression installation instructions with a version-pinned package or release artifact.
  2. Download the installer or executable to a local file without executing it immediately.
  3. Publish a SHA-256 digest through a separately protected release channel and require verification before execution.
  4. Prefer platform-native package managers that provide package signing, version pinning, provenance, and reproducible release metadata.
  5. Cryptographically sign release artifacts and document signature verification using a pinned publisher key.
  6. Pin the expected CLI version and artifact digest rather than relying on mutable install.sh and install.ps1 endpoints.
  7. Give users an opportunity to inspect the downloaded installer before running it.
  8. Document the files, network endpoints, and configuration changes made by installation, and state that installation must not require administrator or root privileges unless strictly necessary.
  9. If an automated installer remains necessary, fail closed when signature or checksum verification cannot be completed.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software using a remote script piped directly into a shell (curl ... | bash). This pattern executes unverified code from the network immediately, creating a supply-chain and remote code execution risk if the host, transport, distribution path, or script contents are compromised.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says to use this skill for ANY Short.io request and instead of calling the API directly, which creates an overly broad trigger surface. Broad invocation language can cause the agent to route unrelated or higher-risk tasks through this skill without sufficient narrowing, increasing the chance of unintended writes, destructive actions, or unsafe fallback behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.