ClawHub
Back to skill

Security audit

TickTick

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent TickTick integration, but its setup instructions include unverified remote installer commands that can execute changing code on the user's machine.

Install only if you are comfortable using OOMOL as an intermediary for TickTick actions and can independently verify or safely install the oo CLI. Be especially careful with the documented remote installer commands, and require explicit confirmation before any TickTick write or delete action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:75
Finding

Unverified Remote Installation Scripts Executed Directly by Shell Interpreters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 75–79
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from cli.oomol.com and immediately pass their contents to Bash or PowerShell. Neither command pins a release, verifies a cryptographic signature or checksum, nor allows inspection of the downloaded artifact before execution.

This creates a remote code-execution channel whose effective payload can change after the Skill has been audited. If the hosting service, DNS resolution, TLS delivery chain, publishing credentials, or installation infrastructure is compromised, an attacker can replace the expected installer with arbitrary commands.

Installation of the required CLI is relevant to the Skill's operation, and these commands are only documented as a fallback when oo is unavailable. However, immediate execution of unverified network content is not the minimum privilege or minimum-risk installation method necessary to provide that functionality.

Attack Path

  1. The user or Agent attempts to use the Skill on a system where the oo CLI is unavailable.
  2. Following the first-time setup instructions, it runs the applicable Bash or PowerShell command.
  3. The command retrieves the current installation script from cli.oomol.com.
  4. A compromised server, release pipeline, account, DNS path, or other delivery component supplies a modified script.
  5. Bash or PowerShell executes the supplied content immediately without integrity verification.
  6. The payload performs arbitrary operations using the permissions and environmental access of the invoking user.

Impact Assessment

Successful exploitation provides arbitrary code ...[truncated 785 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove direct curl | bash and Invoke-RestMethod | Invoke-Expression installation paths.
  2. Prefer a trusted operating-system package manager that enforces publisher signatures and supports installation of a pinned CLI version.
  3. If direct download is unavoidable:
    • Pin an immutable, versioned release URL.
    • Download the installer or binary to a local file without executing it.
    • Publish and verify a pinned SHA-256 or stronger digest over an authenticated channel.
    • Verify a platform-appropriate publisher signature before execution.
    • Abort installation if any integrity or signature check fails.
  4. Present the verified file path, version, publisher, and expected changes to the user before execution.
  5. Run installation with ordinary user privileges unless elevated privileges are demonstrably required for a specific installation target.
  6. Avoid automatically invoking installation commands from the Skill; direct users to independently reviewed installation documentation instead.
  7. Pin the supported oo CLI version so later upstream changes do not silently alter the audited execution behavior.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install the CLI via a piped remote script (curl ... | bash), which executes code fetched at runtime without integrity verification or review. If the hosting site, transport chain, or distribution endpoint is compromised, this can lead to arbitrary code execution on the local machine running the command.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill for "ANY TickTick request" and "Whenever a task involves TickTick," which is extremely broad and can overlap with ordinary mentions of TickTick rather than clear invocation criteria. The file does not provide negative examples or narrower trigger constraints to distinguish when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.