ClawHub
Back to skill

Security audit

Tally

Security checks for vulnerabilities and agentic risk

Overview

The skill’s normal Tally read workflow is coherent, but its setup instructions include unverified remote installer commands that can execute arbitrary local code.

Review before installing. The Tally connector usage itself is read-only and reasonably scoped, but do not run the one-line installer commands unless you trust OOMOL’s installer source and are comfortable with local code execution. Prefer installing the oo CLI through a pinned, verifiable release or official installation flow you inspect first.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Shell Script Execution via curl and Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a mutable network response directly into Bash. It does not pin an immutable release, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded script before execution.

Although the remote domain corresponds to the stated OOMOL provider, domain ownership alone does not guarantee that every future response will be safe. The effective payload can change after the Skill has been reviewed. Compromise of the hosting infrastructure, installer publication process, or delivery path could consequently turn this instruction into arbitrary local code execution.

Installing software is also not required for the Skill's normal Tally read operations when the declared prerequisite—the oo CLI—is already present. Performing installation from Skill instructions therefore exceeds the minimum runtime privileges necessary for searching and reading Tally data.

Attack Path

  1. A Tally action fails because the oo command is unavailable.
  2. The user or agent follows the fallback installation instruction in SKILL.md.
  3. curl retrieves the current contents of https://cli.oomol.com/install.sh.
  4. The response is passed directly to Bash without integrity verification or review.
  5. If the remote script or its delivery infrastructure has been compromised, attacker-controlled shell commands execute with the permissions of the invoking user.
  6. Those commands could access user-readable data and credentials, modify files, install additional software, or establish persistence where the user's permissions permit it.

Impact Assessment

Successful exploitation provides arbitrary command execution in the invoking u ...[truncated 379 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash execution pipeline from the Skill.
  • Keep CLI installation outside normal Skill execution and require an explicit, informed user decision.
  • Direct users to a reviewed installation guide or an official package manager instead of automatically executing downloaded content.
  • Pin the CLI to a specific immutable version rather than retrieving a mutable installer endpoint.
  • Download the installer or release artifact to a local file before execution.
  • Verify a vendor-provided cryptographic signature or a SHA-256 checksum obtained through a trusted, independently authenticated channel.
  • Display the resolved version, source URL, checksum, and intended system changes before requesting explicit approval.
  • Run installation with the least-privileged account possible and avoid privilege elevation unless separately justified and approved.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote PowerShell Script Execution via Invoke-RestMethod

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

This instruction retrieves a mutable PowerShell script using the irm alias for Invoke-RestMethod and immediately evaluates the response with iex, the alias for Invoke-Expression. No release version is pinned, and no signature, publisher identity, or cryptographic digest is checked before execution.

The reviewed Skill therefore cannot constrain or validate the code that ultimately runs. A compromised remote server, publication pipeline, or delivery mechanism could supply arbitrary PowerShell commands after the Skill has passed review. Immediate evaluation also prevents meaningful inspection before execution.

CLI installation is a setup operation rather than a capability required by the declared Tally read actions at runtime. Embedding remote installer execution in the fallback instructions exceeds least privilege and unnecessarily expands the Skill's effective attack surface.

Attack Path

  1. A Windows user or agent encounters an oo: command not found condition.
  2. The fallback instructions lead it to execute the PowerShell installation command.
  3. Invoke-RestMethod downloads the current response from https://cli.oomol.com/install.ps1.
  4. The pipeline sends the unverified response directly to Invoke-Expression.
  5. If the remote content has been replaced or compromised, attacker-controlled PowerShell executes in the current user's context.
  6. The payload could read accessible credentials and files, invoke other processes, download further components, or modify user-level system configuration.

Impact Assessment

Successful exploitation provides arbitrary PowerShell execution with the permissions of the invoking account. This can expose ...[truncated 308 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pipeline and do not evaluate network responses directly.
  • Treat Windows CLI installation as a separate, explicitly approved prerequisite rather than part of Skill runtime behavior.
  • Pin a specific signed CLI release from an official release channel.
  • Save the installer locally and validate its Authenticode signature and expected publisher before running it.
  • Where a script artifact is unavoidable, verify a published SHA-256 digest obtained through a trusted channel.
  • Show the source, version, signer, and expected changes to the user before requesting execution approval.
  • Prefer a trusted package manager that supports publisher validation and version pinning.
  • Execute with standard-user permissions unless elevation is independently necessary, explained, and explicitly approved.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs the agent/user to install software via a remote shell pipeline (curl ... | bash), which executes unverified code fetched at runtime. If the install endpoint, transport, DNS, or hosting is compromised, this can lead to arbitrary code execution on the local system with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY Tally request" and "Whenever a task involves Tally," which is a broad activation condition without scope limits or exclusion examples. In a manifest file, this can cause unintended invocation for loosely related mentions of Tally rather than clearly bounded tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.