ClawHub
Back to skill

Security audit

WeatherAPI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent WeatherAPI connector, but its first-time setup tells users to execute remote installer scripts directly, which needs review before installation.

Review this skill before installing. Normal WeatherAPI queries are narrowly described, but do not run the documented installer commands unless you trust OOMOL's installer delivery path; prefer official installation documentation, a package manager, or a downloaded installer with version and integrity verification.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Installation Scripts Are Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions download mutable scripts from external URLs and immediately execute their contents using Bash or PowerShell. The payloads are not included in the audited project and are not pinned to a specific immutable version. No checksum, cryptographic signature, or other integrity verification is performed before execution.

HTTPS protects the connection in transit under normal conditions, but it does not establish that the remotely hosted script is immutable or safe. A compromise of the vendor account, web server, DNS or certificate infrastructure, build pipeline, or script publication process could replace the installer after this Skill has already passed review.

The installation behavior is not required for normal weather queries: the document states that it is a fallback used when the oo command is unavailable. The normal permission declaration, Bash(oo *), narrows routine operations to the OOMOL CLI and reduces direct automated exposure to arbitrary shell commands. Nevertheless, the fallback documentation explicitly directs the user or agent to establish a remote code-execution channel without prior inspection or approval.

The connector's ordinary network behavior is otherwise consistent with its declared functionality. Commands such as oo connector schema and oo connector run necessarily communicate with the connector service to obtain schemas and weather results. The audited file does not direct the agent to collect raw credentials, private keys, environment variables, or unrelated local files.

Attack Path

  1. The oo CLI is a ...[truncated 1368 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove direct curl | bash and irm | iex installation patterns.
  2. Prefer an established operating-system package manager or trusted application distribution channel with a version-pinned package.
  3. If standalone installers are necessary, pin an explicit release version and use immutable release URLs rather than mutable generic installer endpoints.
  4. Download the installer to a local file without executing it automatically.
  5. Publish and verify a cryptographic signature from a separately trusted key. At minimum, verify a release-specific SHA-256 digest obtained through a trusted channel.
  6. Abort installation if verification fails, and never silently fall back to executing an unverified payload.
  7. Present the verified script or package details to the user and require explicit approval before execution.
  8. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. Isolate any privileged step and explain its exact effect.
  9. Document the expected files, network endpoints, and system changes made by the installer so users can evaluate its scope.
  10. Keep installation outside automatic connector execution. Normal weather operations should remain restricted to the declared oo command scope.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
94% confidence
Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification, gives the remote server full code execution on the local machine, and is especially risky in a skill because an agent may surface or encourage this command during task execution.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Static analysis

No suspicious patterns detected.