ClawHub
Back to skill

Security audit

ZenRows

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for using ZenRows through OOMOL, but its first-time setup tells users to execute unverified remote installer scripts.

Install only if you are comfortable with OOMOL and ZenRows handling the requested URLs and parameters. Avoid running the pasted installer commands directly; prefer official, versioned installation instructions and verify installer contents or checksums before executing them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions retrieve mutable scripts from cli.oomol.com and immediately execute them using Bash or PowerShell. The instructions do not pin a release, verify a cryptographic signature or checksum, save the script for inspection, or constrain its execution.

The domain is consistent with the declared OOMOL author and installing the oo CLI supports the Skill's functionality. However, piping unverified network content directly into an interpreter is not the minimum privilege or minimum-trust mechanism necessary to install that CLI. The effective code can change after the Skill has been audited.

A compromise of the distribution server, DNS infrastructure, release pipeline, or other trusted delivery components could therefore turn these setup commands into arbitrary code execution. The Skill itself contains no embedded malicious script, so the behavior depends on the content returned by the remote service at execution time.

Attack Path

  1. The oo command is unavailable and an agent or user follows the first-time setup instructions.
  2. An attacker compromises the remote installation endpoint or its software delivery pipeline.
  3. The endpoint returns a modified install.sh or install.ps1.
  4. bash or iex executes the response immediately, without integrity verification or an inspection step.
  5. The payload performs arbitrary actions using the permissions of the account that invoked the command.

Impact Assessment

A successful attack obtains arbitrary command execution with the invoking user's privileges. The result ...[truncated 857 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace pipe-to-shell installation with a version-pinned package or release artifact from a documented official distribution channel.
  2. Download the artifact to disk without executing it automatically.
  3. Publish a SHA-256 checksum or cryptographic signature through an independently protected channel and verify it before execution.
  4. Display the resolved version, source URL, checksum, and intended installation location before asking for explicit user approval.
  5. Run the installer as an unprivileged user unless a specific installation step demonstrably requires elevation.
  6. If elevated access is necessary, isolate and clearly identify the exact operation requiring it rather than running the entire remote script with elevated privileges.
  7. Prefer platform package managers with signed metadata and pinned versions where available.
  8. Document an offline or manual installation procedure so users can inspect the downloaded installer before running it.
  9. Apply equivalent protections to both the Bash and PowerShell installation paths.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a classic remote-script execution pattern: piping a downloaded shell script directly into bash. If the install endpoint, transport path, or hosting account is compromised, an agent or user following these instructions could execute arbitrary code on the local system without inspection; the PowerShell variant has the same risk profile.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill for "ANY ZenRows request" and "Whenever a task involves ZenRows," which is a very broad activation condition. It does not define narrower trigger phrases, scope boundaries, or exclusion examples, so the skill could be invoked for loosely related mentions of ZenRows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.