ClawHub
Back to skill

Security audit

SlickText

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a clear SlickText connector, but its setup instructions tell users to run remote installer scripts directly, which is risky enough to require review.

Review the oo CLI installation path before installing. Prefer downloading from an official, versioned source and verifying integrity before running scripts, and confirm exact payloads before allowing SlickText contact creation, updates, or deletion.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Shell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The setup instruction downloads a mutable shell script from an external server and pipes it directly into Bash. The remote content is executed without a pinned version, cryptographic signature, checksum verification, or a separate inspection step.

Although installing the oo CLI supports the Skill's declared functionality and the URL appears associated with OOMOL, immediate execution is not necessary and exceeds the minimum-safe installation behavior. The effective code can change after the Skill has been reviewed. Compromise of the hosting service, publishing account, CDN, DNS resolution, or network trust chain could consequently turn this setup command into arbitrary code execution.

Attack Path

  1. The user or agent attempts to invoke the Skill when the oo CLI is unavailable.
  2. The documented fallback directs it to run the installation command.
  3. curl retrieves the current contents of https://cli.oomol.com/install.sh.
  4. The downloaded content is passed directly to Bash without integrity or authenticity verification.
  5. If the remote installer or its delivery path has been compromised, attacker-controlled commands execute with the privileges of the invoking user.

Impact Assessment

A malicious installer could execute arbitrary commands under the invoking user's account. Depending on that account's existing privileges, it could read or modify accessible files, access credentials available to the process, install additional software, or retrieve further payloads. The project does not include the installer, so its precise behavior and privilege requirements cannot be independently verified from the audited artifact.

Remediation
View remediation

Remediation Suggestions

  • Replace the pipe-to-shell instruction with an official package-manager command or a pinned release artifact from a verifiable repository.
  • Download the installer or binary to a local file before execution.
  • Verify a publisher signature and a pinned SHA-256 checksum obtained through a separately trusted channel.
  • Display the resolved version and request explicit user approval before executing installation code.
  • Run installation with ordinary user privileges unless elevated access is demonstrably required.
  • Document the files, directories, network destinations, and permission changes performed by the installer.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote PowerShell Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script and sends it directly to Invoke-Expression (iex). It therefore executes externally controlled text as PowerShell code without pinning a release, validating a digital signature or checksum, saving the script for inspection, or confirming its contents.

Installation of the required CLI is relevant to the declared functionality, but direct evaluation of a remote response is not the least-privileged or minimum-risk approach. Any malicious modification of the hosted script or compromise of its delivery infrastructure would change the code executed by users without requiring a change to the reviewed Skill file.

Attack Path

  1. The Skill is used on Windows when the oo CLI is not installed.
  2. The user or agent follows the documented first-time setup instruction.
  3. PowerShell downloads the current response from https://cli.oomol.com/install.ps1.
  4. The response is passed immediately to Invoke-Expression.
  5. If an attacker controls the hosted response or compromises its delivery path, arbitrary PowerShell commands run in the invoking user's security context.

Impact Assessment

Exploitation provides arbitrary command execution with the invoking PowerShell process's privileges. Attacker-controlled code could access data and credentials available to that user, alter accessible files and configuration, install additional components, or download subsequent payloads. If the command is launched from an elevated PowerShell session, the resulting impact would extend to those elevated privileges. No claim about the installer's actual behavior can be ...[truncated 67 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Prefer a signed Windows package or a pinned release artifact distributed through a trusted package manager.
  • Download the installer separately and validate its Authenticode signature and a pinned cryptographic checksum before execution.
  • Require explicit user approval after presenting the artifact source, version, and verification result.
  • Avoid administrative execution unless installation genuinely requires it, and document any requested elevation.
  • Publish auditable installation behavior and constrain the installer to the files and permissions required for the CLI.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill recommends installing software via curl ... | bash, which executes a remotely fetched script without prior verification. If the distribution endpoint, transport, or upstream release process is compromised, this can lead to arbitrary code execution on the host running the skill; the risk is heightened because the command appears in a troubleshooting path users may copy verbatim.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY SlickText request" and "Whenever a task involves SlickText," which is extremely broad and lacks constraints or exclusion conditions. This can overlap with many ordinary requests involving SlickText and does not clearly define trigger boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.