Security audit

GitHub

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent GitHub connector, but its first-time setup tells users or agents to run unverified remote installer scripts.

Review the setup path before installing. Prefer installing the oo CLI from a verified, version-pinned source, and only allow GitHub write or destructive actions after checking the exact repository, target, and payload.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:201
Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md:201` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely retrieved script directly into Bash without pinning a version or verifying a cryptographic signature or checksum. Although HTTPS authenticates the server connection under normal conditions, it does not guarantee that the script is immutable or safe. The effective executable payload can change after the Skill has been reviewed. Compromise of the hosting service, deployment infrastructure, DNS or certificate trust chain, or the installer itself could cause arbitrary attacker-controlled commands to run. This behavior exceeds the minimum privilege needed to document installation because safer installation mechanisms can separate downloading, verification, review, and execution. ### Attack Path 1. The `oo` command is unavailable, causing the Agent or user to follow the first-time setup instructions. 2. An attacker compromises or otherwise gains control over the content served from `https://cli.oomol.com/install.sh`. 3. `curl` retrieves the modified payload. 4. The shell pipe passes the response directly to Bash without integrity verification. 5. Bash executes the attacker's commands with the privileges of the invoking Agent or user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking account. Depending on that account's privileges and accessible environment, an attacker could read or alter local files, steal credentials available to the process, modify repositories, establish persistence, or invoke authenticated services. Root-level impact is possible if the instruction is run from a privileged shell, but the Skill itself does not explicitly require or obtain ...[truncated 10 chars]
Remediation: ## Remediation Suggestions - Replace the pipeline with installation from a version-pinned official release or trusted package repository. - Download the installer to a local file without executing it immediately. - Publish and verify a cryptographic signature or checksum through an independently secured channel. - Display or inspect the verified script before execution. - Execute the installer with an unprivileged account and request narrowly scoped elevation only if a specific operation requires it. - Document the exact version, expected digest, provenance, and update procedure. - Prefer commands conceptually equivalent to: ```bash curl -fSLo install.sh "https://trusted.example/releases/vX.Y.Z/install.sh" echo "<EXPECTED_SHA256> install.sh" | sha256sum -c - less install.sh bash install.sh ```

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:205
Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md:205` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction downloads mutable remote PowerShell content with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). No release version, Authenticode signature, checksum, or other integrity control is specified. The commands received from the server therefore become the effective Skill payload at execution time and can differ from the content available during audit. Immediate evaluation also prevents a meaningful verification or review step. A compromise affecting the remote installer or its delivery infrastructure could convert this setup instruction into arbitrary PowerShell execution. ### Attack Path 1. The `oo` command is unavailable on a Windows system. 2. The Agent or user follows the documented first-time installation command. 3. An attacker-controlled or compromised endpoint serves a modified `install.ps1`. 4. `irm` retrieves the payload and passes it directly to `iex`. 5. `iex` executes the malicious PowerShell commands with the invoking process's privileges. ### Impact Assessment Successful exploitation grants arbitrary command execution as the invoking Windows user. An attacker could access that user's files and credentials, alter local configuration, invoke network services available to the account, or attempt persistence and further privilege escalation. Administrator-level compromise is possible if PowerShell is already elevated, although the reviewed instruction does not explicitly request elevation.
Remediation: ## Remediation Suggestions - Do not pipe downloaded content to `Invoke-Expression`. - Use a version-pinned, officially published installer package. - Download the installer separately and verify both its expected hash and Authenticode signature before execution. - Require an identifiable trusted publisher and reject invalid, absent, or unexpected signatures. - Run installation without administrative rights unless a documented operation strictly requires elevation. - Publish the expected version and digest through an independently secured release channel. - Prefer a staged process conceptually equivalent to: ```powershell Invoke-WebRequest "https://trusted.example/releases/vX.Y.Z/install.ps1" -OutFile ".\install.ps1" if ((Get-FileHash ".\install.ps1" -Algorithm SHA256).Hash -ne "<EXPECTED_SHA256>") { throw "Installer integrity verification failed" } Get-AuthenticodeSignature ".\install.ps1" powershell -File ".\install.ps1" ```

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 98% confidence
Finding: The skill instructs the agent to execute a remote install script via `curl ... | bash`, which is a classic supply-chain and arbitrary-code-execution risk. Because the skill is allowed to use Bash and presents this as fallback setup guidance, a failure path could lead the agent to run unverified code fetched at execution time.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: For a markdown/manifest file, activation guidance should be specific enough to avoid unintended invocation. The phrasing on L003 is extremely broad and does not define boundaries or exclusions, so the skill could be selected for loosely related GitHub mentions rather than only appropriate connector-backed operations.

Intent-Code Divergence

Low

Confidence: 96% confidence
Finding: At L086, the inline documentation describes a read-only retrieval action ('Get a GitHub issue comment by ID') but simultaneously tags it as `[write]`, which contradicts the stated behavior of the action. This is an intent/documentation inconsistency that could mislead an agent into treating a safe read as a state-changing operation.

Static analysis

No suspicious patterns detected.