ClawHub
Back to skill

Security audit

Valyu

Security checks for vulnerabilities and agentic risk

Overview

This Valyu connector skill is mostly coherent, but its fallback setup tells users or agents to execute remote installer scripts directly in a shell without verification.

Install only if you are comfortable with OOMOL's oo CLI and Valyu connector model. Avoid running the pasted remote installer commands blindly; prefer reviewing official installation documentation, verifying the installer source or checksum if available, and approving any setup step explicitly before use.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:52
Finding

Unverified Remote Installation Scripts Executed Directly by Shell Interpreters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–61
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

markdown
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  ```

Technical Analysis

The installation instructions retrieve mutable scripts from cli.oomol.com and immediately pass the responses to Bash or PowerShell. Neither command pins a release version, verifies a cryptographic signature or checksum, nor saves the script for inspection before execution.

Although installation is presented as a conditional fallback when the oo CLI is unavailable, it is not required for ordinary Skill operation when the CLI is already installed. Executing an installation script is also more privileged than the Skill's declared search functionality. The content executed can change after the Skill has been reviewed, making the effective code dependent on the remote server and delivery path at execution time.

The audit found no evidence that the current remote scripts are malicious. Nevertheless, compromise of the hosting infrastructure, DNS, account, build pipeline, or script itself could turn these commands into arbitrary code execution. HTTPS reduces network interception risk but does not establish the integrity or immutability of the downloaded payload.

Attack Path

  1. The user or agent attempts to use the Skill on a system where oo is unavailable.
  2. The documented fallback directs execution of the installation command.
  3. curl or Invoke-RestMethod retrieves a mutable script from cli.oomol.com.
  4. The response is passed directly to Bash or Invoke-Expression without integrity verification or revie ...[truncated 998 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all direct curl | bash and Invoke-RestMethod | Invoke-Expression installation patterns.
  2. Prefer an official package manager or a version-pinned release artifact from a documented, trusted repository.
  3. Download the installer to a local file without executing it automatically.
  4. Pin the expected version and verify a publisher signature or an out-of-band published SHA-256 digest before execution.
  5. Display the source, version, destination, and intended system changes to the user.
  6. Require explicit user approval before installing software; the agent should not automatically run installation commands after a failed action.
  7. Run the installer with ordinary user privileges unless a specific, documented operation requires elevation.
  8. If elevation is necessary, separate and explain the privileged step and request explicit approval for that exact operation.
  9. Document uninstall procedures and all files, services, startup entries, or configuration changes made by the installer.
  10. Keep the existing guidance that setup is only a fallback, but direct users to a verified installation guide rather than embedding commands that execute remote responses immediately.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into bash, which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, or hosting environment is compromised, arbitrary code would execute immediately on the user's system with the agent's privileges.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description says to use this skill for ANY Valyu request and whenever a task involves Valyu, which creates an extremely broad trigger surface. Over-broad routing can cause unintended invocation, increasing the chance that users are steered into this skill unexpectedly and exposed to its setup/install instructions or external connector behavior without clear necessity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.