ClawHub
Back to skill

Security audit

Turso

Security checks for vulnerabilities and agentic risk

Overview

The Turso connector skill is mostly coherent, but its first-time setup tells agents to run unverified online installer scripts, which warrants review before installation.

Review the setup path before installing. Prefer a pinned, verifiable oo CLI installation method if available, and do not let an agent run the curl-to-bash or PowerShell invoke-expression installer automatically. Confirm all write or delete Turso operations and avoid sending unnecessary sensitive database information through the connector.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download scripts from an external server and pass the returned content directly to Bash or PowerShell. The effective code is controlled by `cli.oomol.com` and can change after this Skill has been reviewed. Neither installation path pins a release or immutable artifact, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded script before execution. HTTPS protects data in transit but does not protect against a compromised origin, unauthorized server-side modification, malicious deployment, or future changes to the installer. Installing the required CLI when it is absent is related to the declared Turso connector functionality. However, executing mutable network content immediately is not the minimum privilege or safest mechanism necessary to install it. A verified package, pinned release, or separately downloaded and authenticated installer would accomplish the same purpose with less supply-chain risk. The Skill also sends Turso action names and JSON payloads through the OOMOL connector. That network transfer is disclosed by the Skill and is necessary for its stated connector-based design. The reviewed file does not explicitly collect local credentials, SSH keys, environment variables, or unrelated files. Nevertheless, Turso payloads may contain sensitive database information, so users should understand that OOMOL acts as an intermediary and should subm ...[truncated 1629 chars]
Remediation
View remediation
/install.sh" echo " oo-install.sh" | sha256sum --check - less oo-install.sh bash oo-install.sh ``` The release URL and digest must be pinned to authentic published values; placeholders must not be used as operational commands. ]]>

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software via curl ... | bash, which executes remote code directly from the network without integrity verification, pinning, or signature checks. If the distribution endpoint, transport path, or upstream content is compromised, arbitrary code could run on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use this skill for "ANY Turso request" and "Whenever a task involves Turso," which is extremely broad and lacks scope boundaries or exclusion conditions. For a manifest/markdown-scoped trigger review, this creates ambiguity about when the skill should activate versus when general reasoning or another tool might be more appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.