ClawHub
Back to skill

Security audit

TelTel

Security checks for vulnerabilities and agentic risk

Overview

The TelTel connector is coherent, but its setup instructions include unverified remote installer commands that can execute code on the user's machine.

Before installing, use a verified or package-managed oo CLI install path if available, avoid running pipe-to-shell or irm-to-iex commands blindly, and confirm every outbound SMS payload because it changes TelTel state and may affect account usage.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Shell Script Downloaded and Executed on macOS and Linux

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Complete Code Snippet:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes an HTTPS response directly into Bash. The remote script is not pinned to an immutable release, downloaded for inspection, or validated using a cryptographic signature or checksum. Consequently, the effective code executed by this Skill can change after the Skill itself has been reviewed.

HTTPS protects transport under normal conditions but does not establish that every future script served by the endpoint is trustworthy. Compromise of the hosting account, server, CDN, DNS resolution, certificate trust chain, or release process could cause arbitrary attacker-controlled commands to be supplied to Bash.

Installing the CLI is only necessary when the oo command is unavailable. Even in that scenario, immediate execution of mutable remote content exceeds the minimum privilege and trust required to install a dependency safely.

Attack Path

  1. A user or agent attempts a declared TelTel operation.
  2. The operation fails because the oo CLI is not installed.
  3. The Skill directs the user or agent to run the installation pipeline.
  4. The installation endpoint or its delivery chain serves modified shell code.
  5. curl passes the response directly to Bash without integrity verification or review.
  6. The malicious response executes with all permissions available to the invoking account.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's privileges. An attacker could read or alter accessible files, steal local credentials and session material, modify user configuration, install additional malware or persistence mechanisms, and use the compromis ...[truncated 177 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation instruction.
  • Pin installation to a specific, reviewed CLI release from an official release channel.
  • Download the installer or binary to a local file without executing it automatically.
  • Verify a publisher-provided cryptographic signature or a SHA-256 checksum obtained through a separately trusted channel.
  • Display the selected version, source, and verification result before installation.
  • Require explicit user approval before running any installer.
  • Execute installation with ordinary user privileges unless a narrowly scoped operation demonstrably requires elevation.
  • Prefer a trusted operating-system package manager or signed package with version pinning where available.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote PowerShell Script Downloaded and Executed on Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Complete Code Snippet:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell instruction retrieves a mutable remote script with Invoke-RestMethod and passes the returned content directly to Invoke-Expression. No fixed release version, signature check, checksum validation, local review step, or execution restriction is present.

Invoke-Expression interprets the network response as PowerShell code in the current process. This gives the remote endpoint an immediate code-execution channel whose payload can change independently of the audited SKILL.md file. HTTPS alone does not mitigate compromise of the publisher, hosting infrastructure, DNS or certificate ecosystem, or upstream release process.

Installing the CLI may support the declared connector functionality when the executable is absent, but executing an unverified network response is not the least-privilege or least-trust installation method.

Attack Path

  1. A Windows user or agent attempts to use the TelTel connector.
  2. The attempt fails because the oo CLI is unavailable.
  3. The Skill recommends the PowerShell installation command.
  4. An attacker compromises the remote endpoint or another part of its delivery chain.
  5. Invoke-RestMethod retrieves the attacker-controlled response.
  6. Invoke-Expression immediately executes that response without authenticity or integrity verification.
  7. The payload performs arbitrary actions under the PowerShell process's security context.

Impact Assessment

Exploitation enables arbitrary PowerShell execution with the invoking user's privileges. The payload could access readable files, credentials, environment variables, browser or CLI session data, alter user settings ...[truncated 181 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation instruction.
  • Distribute a version-pinned and publisher-signed Windows package or executable.
  • Download the artifact without evaluating it as PowerShell source.
  • Validate its Authenticode signature and, where provided, a SHA-256 checksum from a separately trusted source.
  • Reject installation if the signer, signature, version, or digest does not match the expected value.
  • Require explicit user approval after presenting the source, version, and verification outcome.
  • Avoid administrative execution unless a specific installation step requires it, and clearly disclose that requirement.
  • Prefer a trusted package manager using a pinned package version and verified publisher identity.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script directly without prior verification or integrity checking. If the hosting domain, transport, or script contents are compromised, this can lead to arbitrary code execution on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY TelTel request" and "Whenever a task involves TelTel," which is an intentionally broad activation condition without boundaries or exclusion examples. For a manifest/markdown file, this lacks specificity on trigger scope and could overlap with many loosely related tasks involving TelTel.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.