ClawHub
Back to skill

Security audit

Google Sheets

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Google Sheets work, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the OOMOL CLI installation path before installing. Prefer official, versioned installation instructions with checksum or signature verification, and do not run the remote installer pipeline unless you trust the endpoint and understand it will execute code on your machine. For normal spreadsheet use, confirm all write actions and give explicit approval before destructive actions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:94
Finding
Unverified Remote Installer Download and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 94–98 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download mutable scripts from an external server and immediately execute their contents using Bash or PowerShell. The commands do not pin an immutable release, validate a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded payload before execution. Consequently, the effective code executed by the Skill can change after the Skill itself has been audited. Although the download URLs use HTTPS and appear related to the declared OOMOL service, this does not protect against compromise of the hosting infrastructure, publication account, installer build process, or vendor supply chain. Installing the required CLI is relevant when `oo` is unavailable, but piping an unverified network response directly into a command interpreter exceeds the minimum execution privileges necessary for installation. A safer installation mechanism can separate download, verification, and execution. ### Attack Path 1. The `oo` CLI is not installed, and an agent or user follows the documented first-time setup instructions. 2. The system requests `install.sh` or `install.ps1` from the external OOMOL endpoint. 3. An attacker who has compromised the hosting service, publication process, or other relevant supply-chain component substitutes malicious script content. 4. `bash` or `iex` interprets the response immediately, without integrity or authenticity verification. 5. The malicious installer executes arbitrary commands with the permissions of the user or agent running the installation. 6. Those commands may access or alter any files, credential ...[truncated 847 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation commands. 2. Prefer a trusted platform package manager with a version-pinned package and package-signature verification. 3. If direct artifact installation is necessary: - Pin an explicit CLI version and immutable release URL. - Download the installer or binary to a local file without executing it. - Publish and verify a cryptographic checksum over an independently secured channel. - Verify a vendor signature against a documented, pinned signing identity. - Abort installation if any verification step fails. - Allow the user to inspect the downloaded script before execution. 4. Require explicit user approval before installing software or executing any downloaded installer. 5. Run installation with the least-privileged account possible and avoid privilege elevation unless it is demonstrably required. 6. Document the files, directories, network destinations, and permissions used by the installer. 7. Where possible, instruct users to complete installation manually from an official, authenticated release page rather than allowing an agent to execute remote installation code automatically. ]]>

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
98% confidence
Finding
The skill instructs users to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This creates a supply-chain and remote-code-execution risk: if the hosting endpoint, network path, or script content is compromised, arbitrary commands will run immediately on the user's machine without prior inspection.

Static analysis

No suspicious patterns detected.