中文 EN
Start Review
Skill Trust Decision

oo-docsumo

仅含文档的元技能，核心功能为调用 oo CLI 封装 Docsumo API，但首装指令使用了高危的 curl|bash 远程脚本执行模式，存在供应链注入风险

Install decision first Source: ClawHub Scanned: Sep 15, 2026
Files 1
Artifacts 8
Violations 0
Findings 2
Most direct threat evidence
01
用户读取 SKILL.md，按 'First-time setup' 执行首装命令 Entry · SKILL.md
02
curl 从远程 URL 下载 install.sh 并通过管道直接 bash 执行 Escalation · SKILL.md
03
若攻击者篡改 install.sh，注入任意命令完成 RCE / 凭证窃取 Impact · SKILL.md

Why this conclusion was reached

2/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 3 attack-chain steps and 1 severe findings.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

Attack Chain

01
用户读取 SKILL.md，按 'First-time setup' 执行首装命令

Entry · SKILL.md:60

02
curl 从远程 URL 下载 install.sh 并通过管道直接 bash 执行

Escalation · SKILL.md:60

03
若攻击者篡改 install.sh，注入任意命令完成 RCE / 凭证窃取

Impact · SKILL.md:60

What drove the risk score up

curl|bash 管道远程脚本执行 +25

SKILL.md:60 存在 'curl -fsSL https://cli.oomol.com/install.sh | bash'，攻击者可篡改远程脚本注入任意命令

supply chain 无完整性校验 +10

安装脚本无 hash 校验、无版本锁定，供应链随时可被污染

Most important evidence

High Supply Chain

首装指令使用危险 curl|bash 管道

在 'First-time setup' 中包含 curl -fsSL https://cli.oomol.com/install.sh | bash，攻击者可篡改远程脚本注入任意命令，且无 hash 校验或版本锁定

SKILL.md:60
改用预下载+校验模式（先 wget/curl 下载脚本 → 人工/自动校验 hash → 再执行），或引导用户通过官方包管理器（brew/apt）安装
Medium Supply Chain

远程 PowerShell 安装脚本无校验

Windows 安装使用 irm https://cli.oomol.com/install.ps1 | iex，同理存在远程脚本注入风险

SKILL.md:64
同上，下载后执行

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred NONE
SKILL.md 无文件读写声明
Network Pass
Declared NONE
→
Inferred READ
oo connector run 通过 oo CLI 发起 Docsumo API 调用（文档声明的服务范围内）
Shell Pass
Declared WRITE
→
Inferred WRITE
allowed-tools: [Bash(oo *)] 声明，代码仅调用 oo connector 命令
Environment Pass
Declared NONE
→
Inferred NONE
无环境变量遍历或凭证读取
credential Pass
Declared NONE
→
Inferred NONE
文档明确说明 OOMOL 服务端注入凭证，不在客户端处理

Suspicious artifacts and egress

Critical Dangerous Command
curl -fsSL https://cli.oomol.com/install.sh | bash

SKILL.md:60

Medium External URL
https://static.oomol.com/logo/third-party/docsumo.svg

SKILL.md:10

Medium External URL
https://cli.oomol.com/install-guide.md

SKILL.md:57

Medium External URL
https://cli.oomol.com/install.sh

SKILL.md:60

Medium External URL
https://cli.oomol.com/install.ps1

SKILL.md:64

Medium External URL
https://console.oomol.com/app-connections?provider=docsumo

SKILL.md:76

Medium External URL
https://console.oomol.com/billing/token-recharge

SKILL.md:79

Medium External URL
https://www.docsumo.com

SKILL.md:83

Dependencies and supply chain

There are no structured dependency warnings.

File composition

1 files · 83 lines
Markdown 1 files · 83 lines
Files of concern · 1
SKILL.md Markdown · 83 lines
首装指令使用危险 curl|bash 管道 · 远程 PowerShell 安装脚本无校验 · curl -fsSL https://cli.oomol.com/install.sh | bash · https://static.oomol.com/logo/third-party/docsumo.svg · https://cli.oomol.com/install-guide.md · https://cli.oomol.com/install.sh · https://cli.oomol.com/install.ps1 · https://console.oomol.com/app-connections?provider=docsumo · https://console.oomol.com/billing/token-recharge · https://www.docsumo.com

Security positives

纯文档技能，无实际脚本文件，无法植入阴影代码
凭证管理在服务端（OOMOL），客户端不处理原始 token
声明的 Bash 权限与实际 oo connector 调用行为一致
文档清晰标注了 write/destructive 动作，需用户确认
无文件系统、凭证收割、数据外泄等高危行为