ClawHub
Back to skill

Security audit

Similarweb

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Similarweb connector purpose, but its setup instructions tell users to execute remote installer scripts directly, which deserves review before installation.

Before installing, treat the oo CLI setup step as local software installation with full user-level code execution. Prefer official, versioned installation documentation, inspect the installer first, and verify checksums or signatures where available; do not let an agent automatically run the curl-to-bash or irm-to-iex commands without explicit approval.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:57
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from cli.oomol.com and execute them immediately through Bash or PowerShell. The downloaded content is not pinned to a reviewed version and is not validated using a published cryptographic signature or checksum before execution.

HTTPS protects the connection in transit under normal conditions, but it does not establish that the delivered script is identical to a previously audited release. A compromise of the distribution server, hosting account, DNS or TLS trust chain, deployment pipeline, or installer itself could cause arbitrary attacker-controlled commands to run locally.

The PowerShell form uses Invoke-Expression through the iex alias, while the Unix form pipes the response directly into Bash. Both patterns eliminate a meaningful opportunity to inspect and verify the payload before execution. Installing the CLI may support the declared functionality, but immediate execution of unverified remote content exceeds the minimum privilege needed to document or invoke the Similarweb connector.

The audit found no evidence in the reviewed file that the Skill itself steals credentials, installs persistence, or contains an embedded malicious payload. The ordinary connector commands necessarily transmit action parameters through OOMOL, and the documentation states that Similarweb credentials are injected server-side.

Attack Path

  1. The oo command is unavailable, causing the Agent or user to follow the first-time setup instructions.
  2. An attacker compromises or gains control over the installe ...[truncated 1208 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash and irm | iex installation patterns.
  • Direct users to a version-pinned release from the verified official distribution channel.
  • Download the installer or binary to disk as a separate step rather than executing the network response directly.
  • Publish and require verification of a SHA-256 checksum obtained through an independently protected channel, or preferably verify a cryptographic release signature.
  • Display the exact version, source URL, expected digest, and installation effects before execution.
  • Require explicit user approval before installing software; the Agent should not automatically install the CLI following a failed command.
  • Prefer a trusted package manager with signed packages and version pinning where available.
  • Run installation with ordinary user privileges unless a clearly documented operation strictly requires elevation.
  • After installation, verify the installed executable's path and signature or digest to reduce tool-replacement risk.
  • Preserve the existing policy of attempting connector actions only after installation, authentication, and connection have been intentionally completed by the user.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
94% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote-code-execution risk: if the server, transport, DNS, or publishing pipeline is compromised, arbitrary code would run immediately on the user's machine without inspection. In a skill file, this is more dangerous because it is presented as an operational troubleshooting step that users may execute reflexively.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Static analysis

No suspicious patterns detected.