中文 EN
Start Review
Skill Trust Decision

oo-telegram

声明仅允许运行 oo* 命令，但文档包含未声明的 curl|bash 远程脚本执行命令，权限边界不清晰。

Install decision first Source: ClawHub Scanned: 22 days ago
Files 1
Artifacts 8
Violations 1
Findings 3
Most direct threat evidence
01
用户阅读 SKILL.md 了解 Telegram Bot 操作功能 Entry · SKILL.md
02
首次使用若 oo 命令不存在，执行 curl|bash 安装远程脚本 Escalation · SKILL.md
03
远程脚本可能被篡改执行恶意命令（供应链风险） Impact · SKILL.md

Why this conclusion was reached

3/4 dimensions flagged
Block
Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 3 attack-chain steps and 0 severe findings.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

Attack Chain

01
用户阅读 SKILL.md 了解 Telegram Bot 操作功能

Entry · SKILL.md:1

02
首次使用若 oo 命令不存在，执行 curl|bash 安装远程脚本

Escalation · SKILL.md:104

03
远程脚本可能被篡改执行恶意命令（供应链风险）

Impact · SKILL.md:104

What drove the risk score up

未声明的远程脚本执行 +25

SKILL.md:104 包含 curl -fsSL https://cli.oomol.com/install.sh | bash，超出 allowed-tools 声明的 Bash(oo *) 范围

文档-行为差异 +15

声明仅操作 Telegram Bot，但安装脚本执行任意命令

供应链风险 +10

远程脚本内容不可控，存在供应链攻击风险

Most important evidence

Medium Priv Escalation

安装命令超出 allowed-tools 声明范围

allowed-tools 声明为 Bash(oo *)，仅允许执行 oo 开头的命令。但 SKILL.md:104 包含 curl -fsSL https://cli.oomol.com/install.sh | bash，这是未声明的任意 shell 命令执行能力。

SKILL.md:104
将安装命令限制在声明的权限范围内，或更新 allowed-tools 声明以反映实际需要的权限
Medium Supply Chain

远程脚本执行引入供应链风险

从 cli.oomol.com 下载安装脚本并直接执行 | bash。脚本内容不在 Skill 管控范围内，存在供应链攻击风险（脚本被篡改、依赖被替换等）。

SKILL.md:104
使用官方包管理器安装或提供脚本 hash 校验
Low Doc Mismatch

文档声称与实际操作存在偏差

文档声称 'OOMOL injects credentials server-side, so you never handle raw tokens' 和 'allowed-tools: [Bash(oo *)]'，但安装步骤执行了 curl|bash 管道，超出声明范围。

SKILL.md:1
明确说明安装阶段需要放宽权限约束及原因

Declared capability vs actual capability

Shell Pass
Declared WRITE
→
Inferred WRITE
SKILL.md:104 远程脚本执行超出声明的 oo* 命令范围
Network Block
Declared NONE
→
Inferred READ
SKILL.md:104 curl 从外部 URL 下载脚本

Suspicious artifacts and egress

Critical Dangerous Command
curl -fsSL https://cli.oomol.com/install.sh | bash

SKILL.md:104

Medium External URL
https://static.oomol.com/logo/third-party/Telegram.svg

SKILL.md:10

Medium External URL
https://cli.oomol.com/install-guide.md

SKILL.md:101

Medium External URL
https://cli.oomol.com/install.sh

SKILL.md:104

Medium External URL
https://cli.oomol.com/install.ps1

SKILL.md:108

Medium External URL
https://console.oomol.com/app-connections?provider=telegram

SKILL.md:120

Medium External URL
https://console.oomol.com/billing/token-recharge

SKILL.md:123

Medium External URL
https://core.telegram.org/bots

SKILL.md:127

Dependencies and supply chain

There are no structured dependency warnings.

File composition

1 files · 127 lines
Markdown 1 files · 127 lines
Files of concern · 1
SKILL.md Markdown · 127 lines
安装命令超出 allowed-tools 声明范围 · 远程脚本执行引入供应链风险 · 文档声称与实际操作存在偏差 · curl -fsSL https://cli.oomol.com/install.sh | bash · https://static.oomol.com/logo/third-party/Telegram.svg · https://cli.oomol.com/install-guide.md · https://cli.oomol.com/install.sh · https://cli.oomol.com/install.ps1 · https://console.oomol.com/app-connections?provider=telegram · https://console.oomol.com/billing/token-recharge · https://core.telegram.org/bots

Security positives

声明了丰富的 Telegram Bot 操作接口，意图清晰
使用 OOMOL server-side 凭证注入，不在客户端暴露 token
区分了 read/write/destructive 操作，并要求确认
提供完整的 action schema 文档