ClawHub
Back to skill

Security audit

Tomba

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Tomba connector, but its fallback setup tells users or agents to run mutable remote installer scripts directly in a shell.

Review this skill before installing. Its normal Tomba lookup behavior is disclosed and scoped through the oo CLI, but do not run the documented installer pipe commands automatically; install the oo CLI through a verified, inspectable, versioned method and only use the skill with a Tomba/OOMOL account you intend to query.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:60
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

markdown
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  ```

Technical Analysis

The installation instructions retrieve mutable scripts from external URLs and immediately pass their contents to Bash or PowerShell. Neither command pins a release version, verifies a checksum, validates a cryptographic signature, nor gives the user an opportunity to inspect the downloaded script before execution.

HTTPS protects the connection in transit under normal conditions, but it does not establish that the script currently hosted at the URL is the same code that was reviewed. Compromise of the hosting account, web server, CDN, DNS infrastructure, TLS credentials, or release process could cause arbitrary attacker-controlled code to be returned and executed.

Installing the CLI is only a first-time fallback when oo is unavailable and is not necessary during normal Skill execution. The declared runtime capability is narrowly limited to Bash(oo *), but these installation instructions establish a separate, unauditable bootstrap path with unrestricted shell execution. The remote installer contents were not included in the audited project, so their behavior and privilege requirements could not be verified.

The Skill also intentionally sends action names and user-provided JSON to the OOMOL Tomba connector. Such data can include email addresses, names, domains, or LinkedIn URLs. This network transmission is disclosed and is functionally necessary for the declared remote lookup service; the reviewed file pro ...[truncated 1894 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove both direct pipe-to-shell installation commands from the Skill instructions.
  2. Prefer an authenticated operating-system package manager or an official, versioned release package with a reviewable installation process.
  3. Pin the CLI to an explicit version rather than retrieving a mutable install.sh or install.ps1 endpoint.
  4. Publish SHA-256 checksums through an independently authenticated release channel and require users to verify the downloaded artifact before execution.
  5. Cryptographically sign release artifacts and document signature verification using a pinned publisher key or platform-native code-signing mechanism.
  6. Use a download-verify-execute workflow so the installer is saved locally and can be inspected before it is run.
  7. Document the exact files, directories, network endpoints, and permissions required by the installer. Do not request administrator privileges unless a clearly identified installation mode strictly requires them.
  8. Keep CLI installation outside automated Skill execution. If oo is missing, report the condition and direct the user to verified installation documentation rather than executing installation commands.
  9. For stronger supply-chain assurance, distribute reproducible build instructions and provenance attestations so users can confirm that release artifacts correspond to reviewed source code.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). That pattern enables arbitrary code execution if the remote server, distribution path, TLS trust chain, or content delivery is compromised, and the skill content is adversarial input that should not be trusted to bootstrap code execution. The context makes this more dangerous because it appears in a fallback flow that could be triggered during normal skill use, turning an operational error into a code-execution path on the host.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description instructs invocation for any task involving Tomba, including broad phrases like "searching and reading data," without narrowing contexts or exclusions. This can cause unintended activation whenever Tomba is merely mentioned, rather than only when the user explicitly wants connector-backed Tomba operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.