ClawHub
Back to skill

Security audit

Upstash Redis

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its Upstash Redis purpose, but its first-time setup includes unsafe commands that directly execute downloaded installer scripts.

Review the first-time setup before installing. Prefer installing the oo CLI from a verified, versioned source with checksum or signature validation, and only allow write or destructive Redis actions after checking the exact key and payload.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Installation Script Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command retrieves a mutable script from an external URL and pipes the response directly into Bash. It does not pin a release, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution.

HTTPS protects data in transit but does not ensure that the published script remains trustworthy. Compromise of the hosting infrastructure, publishing account, DNS, or certificate chain—or an unintended upstream modification—could cause arbitrary replacement code to execute. The instruction is conditional on the oo command being unavailable, but CLI installation is separate from the Skill's core Redis operation and exceeds its declared Bash(oo *) runtime tool scope.

Attack Path

  1. A user requests an Upstash Redis operation.
  2. The Skill attempts to invoke the oo CLI.
  3. The CLI is unavailable, causing the first-time setup guidance to apply.
  4. The installation command downloads the current response from https://cli.oomol.com/install.sh.
  5. Bash immediately interprets the response without integrity or authenticity verification.
  6. If the remote content or delivery infrastructure has been compromised, attacker-controlled commands execute with the invoking user's privileges.

Impact Assessment

A substituted installation script could execute arbitrary commands with the permissions of the user running the agent. Depending on those permissions, it could read or modify local files, access environment variables and credentials, install additional software, alter shell configuration, exfiltrate information, or establish persistence. System-wide impact would be possible if t ...[truncated 46 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash installation path from agent-executable instructions.
  • Require the user to install the CLI outside the Skill's operational flow and obtain explicit approval before any installation.
  • Use a trusted package manager or a version-pinned release artifact.
  • Download the artifact without executing it, then verify a vendor signature and a checksum obtained through an independent trusted channel.
  • Execute the installer only after successful verification and, where practical, user inspection.
  • Run installation with the least-privileged account and avoid elevated privileges.
  • Keep the Skill restricted to its declared Bash(oo *) commands rather than expanding access to arbitrary shell commands.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote Installation Script Executed Through PowerShell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell instruction uses Invoke-RestMethod (irm) to retrieve a mutable script and passes the response directly to Invoke-Expression (iex). This causes the downloaded text to execute immediately in the current PowerShell context. No release version is pinned, and no checksum, digital signature, or publisher validation is performed.

The use of HTTPS does not mitigate compromise of the vendor's hosting or publishing systems. Because the payload is obtained at execution time, its effective behavior can change after the Skill has been reviewed. Installing the CLI is also outside the minimum permissions required to perform an already-configured Redis connector action and conflicts with the declared restriction to Bash(oo *).

Attack Path

  1. A user requests an Upstash Redis operation on a Windows environment.
  2. The oo CLI is not installed, leading to the documented first-time setup path.
  3. PowerShell retrieves the current content from https://cli.oomol.com/install.ps1.
  4. The response is passed directly to Invoke-Expression.
  5. No integrity or publisher verification occurs before execution.
  6. A compromised remote response executes attacker-controlled PowerShell commands with the invoking user's privileges.

Impact Assessment

A malicious replacement script could run arbitrary PowerShell operations, read accessible files and credentials, change user or system configuration, download additional payloads, exfiltrate data, or create persistent execution mechanisms. If invoked from an elevated PowerShell session, the payload could affect system-wide resources and other users.

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex pattern and prevent the Skill from automatically installing software.
  • Direct users to a trusted, version-pinned package or signed release artifact.
  • Save the installer to disk without executing it, validate its Authenticode signature and a published cryptographic checksum, and reject it if validation fails.
  • Obtain explicit user approval after showing the verified artifact, source, version, and expected system changes.
  • Perform installation under a non-administrative account unless elevation is demonstrably necessary.
  • Keep setup separate from normal Redis actions and retain the declared least-privilege restriction to oo commands.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into a shell (curl ... | bash). This is dangerous because it executes unverified code from the network immediately, enabling remote code execution if the hosting endpoint, DNS/TLS trust chain, or distribution pipeline is compromised. In a skill context, this is more dangerous because it normalizes unsafe installation behavior as part of routine task execution.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Static analysis

No suspicious patterns detected.