ClawHub
Back to skill

Security audit

UptimeRobot

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing UptimeRobot through OOMOL, but its setup instructions include unverified remote script execution that users should review carefully.

Install only if you trust OOMOL and are comfortable with the oo CLI setup. Prefer reviewing or verifying the installer through OOMOL's official installation guide before running the remote install commands, and confirm exact payloads before any create, update, or delete action in UptimeRobot.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Unverified Remote Shell Script Execution During CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and pipes the response directly into Bash. The script is not pinned to a specific release, saved for inspection, or verified using a cryptographic signature or checksum before execution.

Although the URL belongs to the declared OOMOL service provider and the command is presented only as a fallback when oo is unavailable, trusting the domain alone does not establish the integrity of the retrieved payload. A compromise of the hosting infrastructure, DNS or TLS delivery chain, deployment credentials, or installer itself could cause arbitrary commands to execute under the invoking user's account. The effective code can also change after the Skill has been reviewed.

Attack Path

  1. An attacker compromises the installer endpoint, its deployment process, or another part of the delivery chain.
  2. The attacker modifies the response from https://cli.oomol.com/install.sh to include malicious shell commands.
  3. A user encounters the documented oo: command not found condition and follows the installation instruction.
  4. curl retrieves the attacker-controlled response and streams it directly to Bash.
  5. Bash executes the payload immediately without integrity verification or an inspection step.

Impact Assessment

Successful exploitation permits arbitrary command execution with all privileges available to the user running the command. The payload could read or modify accessible files, steal environment variables and credentials, alter shell configuration, install persistence, or download additional malware. If the command is invoked from an elevated shell, the impact may ...[truncated 250 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the direct curl | bash pattern with a version-pinned installer artifact from a verified release.
  • Download the artifact to a local file without executing it automatically.
  • Publish and require verification of a cryptographic signature or checksum over a trusted channel.
  • Allow users to inspect the downloaded script before execution.
  • Prefer a signed operating-system package or package-manager distribution with provenance verification.
  • Run installation with ordinary user privileges unless a specific, documented operation requires elevation.
  • Document the expected installer behavior, files created, network destinations, and required permissions.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote PowerShell Execution During CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The Windows installation instruction retrieves a mutable PowerShell script with Invoke-RestMethod (irm) and passes its contents directly to Invoke-Expression (iex). This executes the remote response as PowerShell code without release pinning, signature validation, checksum verification, local inspection, or an approval boundary between retrieval and execution.

The endpoint is associated with the declared OOMOL provider, but a trusted domain does not eliminate supply-chain or hosting compromise risks. Because the effective payload is controlled remotely and can change after review, the package itself does not define the code that this instruction ultimately executes.

Attack Path

  1. An attacker gains control of the PowerShell installer, its publishing credentials, hosting environment, or delivery chain.
  2. The attacker inserts malicious PowerShell commands into the response from https://cli.oomol.com/install.ps1.
  3. A Windows user follows the fallback installation instruction after the oo command is not found.
  4. Invoke-RestMethod downloads the modified response.
  5. Invoke-Expression immediately evaluates the response in the user's PowerShell session.
  6. The malicious code operates with the session's current privileges.

Impact Assessment

Exploitation provides arbitrary PowerShell execution with the invoking user's permissions. An attacker could access user files, credentials, environment variables, browser or application data, modify PowerShell profiles, create persistence, or retrieve additional payloads. Execution from an elevated PowerShell session could result in system-wide compromise.

As with the Unix insta ...[truncated 252 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe downloaded content into Invoke-Expression.
  • Distribute a versioned PowerShell script or signed installer from a verified release.
  • Download the installer separately and validate an Authenticode signature or cryptographic checksum before execution.
  • Require an explicit user review and execution step after successful verification.
  • Prefer a trusted Windows package manager or signed MSI/MSIX package with verifiable publisher identity.
  • Avoid administrative execution unless clearly required and document every elevated operation.
  • Publish installer provenance, expected filesystem changes, network access, and rollback instructions.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a 'curl ... | bash' installation command that fetches a remote script and executes it immediately, which is a classic supply-chain and remote code execution risk. If the remote host, script, DNS, TLS trust chain, or distribution channel is compromised, an agent or user following this instruction could run attacker-controlled code on the local system.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description says to use this skill for ANY UptimeRobot request and instead of calling the API directly, which is broad enough to cause over-selection whenever UptimeRobot is mentioned. That can steer an agent into using this skill in contexts where a narrower or more appropriate tool should be chosen, increasing the chance of unintended reads or state-changing operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.