ClawHub
Back to skill

Security audit

The Dog API

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using The Dog API through OOMOL, but its setup instructions include unverified remote installer commands that execute downloaded code directly.

Review the setup commands before installing. Prefer installing the oo CLI through a verified, versioned, signed, or package-manager-based method rather than executing remote scripts directly. For normal use, confirm any create or delete action before allowing it to run against your The Dog API account.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote Installer Executed Through a Shell Pipeline

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable script from an external server and pipes it directly into bash. The script is executed without pinning a version, verifying a cryptographic checksum or signature, or allowing the user to inspect the downloaded artifact first.

Although HTTPS protects the network connection under normal conditions, it does not make the installer immutable and does not mitigate compromise of the hosting service, domain, CDN, publishing account, or release process. The payload executed by this command can therefore differ from the content that existed when the Skill was audited.

Installing the oo CLI is related to the Skill's declared connector functionality. However, immediate execution of unverified remote content exceeds the minimum privileges necessary to provide installation guidance. A safer process can download a pinned artifact, verify its integrity, and request explicit approval before execution.

Attack Path

  1. The user or agent attempts to use the Skill when the oo CLI is unavailable.
  2. The documented first-time setup procedure is selected.
  3. An attacker compromises or otherwise gains control over the remote installer endpoint or its release pipeline.
  4. curl retrieves the attacker-controlled version of install.sh.
  5. The shell pipeline passes the response directly to bash without integrity verification or review.
  6. The malicious installer executes with the privileges of the user running the command.

Impact Assessment

Successful exploitation permits arbitrary shell command execution with the invoking user's privileges. Depending on those privileges and the malicious payload, the attac ...[truncated 521 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Pin the CLI to a specific reviewed version and use an immutable, versioned release artifact.
  • Download the artifact to a local file without executing it automatically.
  • Publish and verify a SHA-256 digest or, preferably, a cryptographic signature whose trusted public key is distributed separately.
  • Present the resolved download URL, version, expected checksum, destination, and intended file-system changes to the user.
  • Require explicit user approval before running the verified installer.
  • Prefer a trusted package manager that supports signed metadata and version pinning.
  • Run installation with ordinary user privileges unless a documented installation step strictly requires elevation.
  • Document any files, permissions, environment settings, or executables changed by installation.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:69
Finding

Unverified Remote PowerShell Installer Executed with Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 69
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell installation instruction retrieves remote content with Invoke-RestMethod and immediately evaluates it with Invoke-Expression. This creates a direct remote code-execution channel in which the effective payload is controlled by the current response from the external endpoint.

No fixed release version, checksum, signature, or manual inspection step is required. Consequently, a compromise of the endpoint or associated delivery infrastructure can turn the documented installation command into arbitrary PowerShell execution. HTTPS alone does not establish the long-term integrity or immutability of the script.

The CLI is relevant to the Skill's stated operation, but evaluating mutable network content directly is not necessary to install it and violates least-privilege installation practices.

Attack Path

  1. A Windows user reaches the first-time setup instructions because the oo CLI is not installed.
  2. An attacker compromises the installer endpoint, publishing account, CDN, DNS path, or release infrastructure.
  3. Invoke-RestMethod downloads the modified install.ps1 response.
  4. The pipeline supplies the response directly to Invoke-Expression.
  5. The attacker-controlled PowerShell code runs immediately in the user's current PowerShell context.
  6. The payload can perform any operation available to that user or to an elevated PowerShell session.

Impact Assessment

Exploitation enables arbitrary PowerShell execution with the invoking user's privileges. Potential impact includes reading and modifying accessible files, collecting environment or account data, changing user configuration, downloading further payloads ...[truncated 320 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the Invoke-RestMethod | Invoke-Expression pattern.
  • Pin a specific CLI release and download the corresponding PowerShell installer or binary to a local file.
  • Validate a published SHA-256 digest and a trusted digital signature before execution.
  • Display the artifact source, version, signer, checksum, destination, and expected system changes.
  • Require explicit user confirmation after verification and before execution.
  • Prefer signed packages distributed through a trusted Windows package manager.
  • Avoid administrator privileges unless they are strictly necessary and clearly explained.
  • Configure the installation flow to fail closed if signature or checksum validation is unavailable or unsuccessful.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote-code-execution risk: if the install endpoint, transport, or upstream publisher is compromised, arbitrary code will run immediately on the user's machine. In a skill context, this is more dangerous because the content is framed as operational guidance the agent may surface or execute when setup fails.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Static analysis

No suspicious patterns detected.