ClawHub
Back to skill

Security audit

TimelinesAI

Security checks for vulnerabilities and agentic risk

Overview

The skill’s TimelinesAI connector behavior is mostly coherent, but its setup instructions include unverified remote script execution that users should review before installing.

Before installing, review the OOMOL CLI installation source and prefer a signed or package-manager install path with checksum verification. Do not let an agent run the remote installer automatically; once oo is installed and connected, the TimelinesAI actions themselves are reasonably scoped, with message-sending requiring confirmation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:63
Finding

Unverified Remote Shell Script Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Remote payload retrieval and execution through a shell pipeline
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes a remotely retrieved shell script directly into Bash. The remote payload is not pinned to an immutable release and is not validated using a cryptographic signature or published checksum before execution. Consequently, the effective code can change after the Skill package has been audited.

Although the URL is presented as the official OOMOL CLI domain, this pattern relies on the continuing integrity of the remote hosting infrastructure, release pipeline, domain, DNS resolution, and TLS trust chain. A compromise of any relevant upstream component could replace the installer with attacker-controlled shell commands.

This behavior exceeds the minimum privileges required for operating the declared TimelinesAI connector. Connector actions only require an already-installed oo CLI. Automatically executing an unverified installer is a separate code-execution capability and should not occur without explicit user approval and integrity validation.

Attack Path

  1. The oo CLI is absent, causing an action to fail with oo: command not found.
  2. The agent or user follows the documented first-time setup instruction.
  3. curl retrieves the current contents of https://cli.oomol.com/install.sh.
  4. The response is streamed directly to Bash without being saved, inspected, version-pinned, or verified.
  5. If the remote server, publishing pipeline, domain resolution, or trusted delivery path has been compromised, attacker-controlled commands execute under the invoking user's account.
  6. The payload can access resources available to that account and may modify the local environment or install additional co ...[truncated 699 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash pipeline from the Skill instructions.
  • Prefer a trusted platform package manager or a signed, version-pinned OOMOL CLI release.
  • If script-based installation is necessary, download the artifact to a local file without executing it immediately.
  • Pin the installer to a specific immutable release rather than a mutable generic URL.
  • Verify a publisher signature and a SHA-256 checksum obtained through an independently trusted channel.
  • Allow the user to inspect the downloaded script before execution.
  • Require explicit user approval before running any installer because installation is outside ordinary TimelinesAI connector operations.
  • Run the installer with the least-privileged account possible and document any files, permissions, or system settings it changes.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding

Unverified Remote PowerShell Script Executed with Invoke-Expression

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 67
Vulnerability Type: Remote payload retrieval and execution through PowerShell
Risk Level: High

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The instruction uses Invoke-RestMethod (irm) to retrieve mutable PowerShell content and passes it directly to Invoke-Expression (iex). This executes the network response in memory without first pinning a release, validating an Authenticode signature, checking a cryptographic digest, or allowing the user to inspect the downloaded content.

The command therefore delegates local code execution to content currently returned by an external service. Even if the listed domain is legitimate, compromise of its infrastructure or software publishing process could turn this setup command into an arbitrary PowerShell execution mechanism after the Skill has already passed review.

This capability is not required for routine TimelinesAI operations. The declared connector commands need the existing oo CLI, while fetching and interpreting arbitrary remote PowerShell code introduces a broader local execution privilege.

Attack Path

  1. A Windows environment does not have the oo CLI installed.
  2. The agent or user follows the documented Windows first-time setup command.
  3. Invoke-RestMethod retrieves the current response from https://cli.oomol.com/install.ps1.
  4. The response is immediately supplied to Invoke-Expression.
  5. A compromised installer host, publishing pipeline, domain resolution, or trusted delivery path supplies attacker-controlled PowerShell.
  6. PowerShell executes the payload with the permissions and accessible security context of the invoking user.

Impact Assessment

Exploitation could provide arbitrary PowerShell execution with the invoking user's privileges. The resulting scope may include read ...[truncated 517 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Distribute the Windows CLI through a signed, version-pinned installer or a trusted package manager.
  • Download the installer to disk separately instead of evaluating the network response directly.
  • Validate the installer's Authenticode signature and compare its SHA-256 checksum with a value published through an independently trusted channel.
  • Provide the user an opportunity to inspect the downloaded script.
  • Require explicit approval before installation and warn users not to run the installer from an elevated session unless elevation is demonstrably necessary.
  • Document the expected publisher identity, release version, installation paths, permissions, and system modifications.
  • Keep ordinary connector execution separate from optional setup so an agent cannot silently install software while processing a TimelinesAI request.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill includes a classic pipe-to-shell install command that fetches a remote script and executes it immediately, which creates a supply-chain and remote code execution risk if the hosting site, transport, or script content is compromised. Because the skill explicitly instructs running this when oo is missing, an agent or user could be induced to execute unreviewed code on the local system.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY TimelinesAI request" and "Whenever a task involves TimelinesAI," which is a very broad trigger condition. It does not provide scope boundaries, exclusions, or negative examples, so routine mentions of TimelinesAI could incorrectly activate the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.