Security audit

Slack Bot

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Slack Bot automation, but its fallback setup tells users to execute unverified remote installer scripts directly in a shell.

Before installing, review the OOMOL CLI installation path carefully. Prefer a verified package or signed, pinned release instead of running the documented remote shell commands directly, and confirm any Slack write or destructive action before the agent runs it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:96
Finding: Unverified Remote Shell Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, line 96 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command retrieves a mutable script from an external server and pipes it directly into Bash. The remote payload is neither pinned to a reviewed version nor validated using a cryptographic checksum or signature before execution. Consequently, the code that executes may differ from the content available when the Skill was audited. Trust is delegated to the remote host, its infrastructure, DNS and TLS trust chain, and any systems used to publish the installer. Although installing the CLI supports the declared Slack connector functionality, immediate execution of an unverified remote payload exceeds the minimum necessary installation behavior. ### Attack Path 1. The `oo` command is unavailable in the environment. 2. The agent or user follows the first-time setup instructions. 3. An attacker compromises the installer host, publishing pipeline, CDN, or another component of the delivery path. 4. `curl` retrieves the modified `install.sh` payload. 5. The shell executes the payload immediately without an inspection or integrity-verification step. 6. The malicious installer performs arbitrary actions using the privileges of the account that invoked the command. ### Impact Assessment Successful exploitation permits arbitrary command execution with the current user's privileges. The accessible scope may include user files, environment variables, active session data, locally available credentials, and modification of user-level applications or configuration. If the command is invoked from a privileged account, the impact expands to all resources available to that account. No privilege escalation or persistence behavior is directly demonstrated in t ...[truncated 103 chars]
Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation pattern. - Prefer an official package manager that supports pinned package versions and package-signature verification. - If a standalone installer is required, download a versioned artifact to a local file without executing it immediately. - Publish the expected SHA-256 or stronger digest through an independently protected release channel and verify it before execution. - Cryptographically sign release artifacts and verify the signature against a pinned, documented publisher key. - Allow the user to inspect the downloaded script before explicitly approving execution. - Run installation with ordinary user privileges unless a specific, documented operation strictly requires elevation. - Pin the documentation to a reviewed installer version rather than an unversioned mutable endpoint.

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:100
Finding: Unverified Remote PowerShell Payload Executed with Invoke-Expression## Vulnerability Details **File Location**: `SKILL.md`, line 100 **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: Critical ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` retrieves content from the remote URL, while `iex` interprets the returned text as PowerShell code in the current session. This executes mutable remote content without version pinning, local review, checksum validation, or digital-signature verification. The instruction creates a direct remote code-execution channel controlled by whatever content the endpoint returns at invocation time. Installing the CLI is related to the declared functionality, but executing the response through `Invoke-Expression` is not the least-risk installation method. ### Attack Path 1. The `oo` CLI is missing on a Windows environment. 2. The agent or user follows the documented first-time setup command. 3. An attacker gains control of the installer, release pipeline, hosting infrastructure, or another trusted delivery component. 4. `Invoke-RestMethod` retrieves attacker-modified PowerShell source. 5. The pipeline passes that source directly to `Invoke-Expression`. 6. PowerShell executes the payload under the security context of the invoking user. ### Impact Assessment Successful exploitation permits arbitrary PowerShell execution with the invoking user's privileges. Potentially exposed resources include user documents, environment data, accessible browser or application state, local configuration, and credentials available to that security context. A privileged PowerShell session would substantially increase the affected scope. The audited file does not itself prove credential theft, persistence, or privilege escalation; those outcomes would depend on the remotely supplied payload.
Remediation: ## Remediation Suggestions - Remove the `irm ... | iex` pattern. - Distribute a versioned, Authenticode-signed PowerShell script or signed installer package. - Download the artifact to disk first and verify its publisher signature and cryptographic digest before execution. - Abort installation if the expected signer, version, hash, or signature validation does not match. - Prefer a trusted Windows package manager with package signing and explicit version pinning. - Require explicit user approval after presenting the artifact source, version, verification result, and expected system changes. - Avoid administrative execution unless a narrowly defined installation step requires it. - Document how users can independently verify the publisher certificate and release digest.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 98% confidence
Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell, which creates a supply-chain and remote code execution risk if the server, transport, or distribution path is compromised. In this skill context, the danger is heightened because the content is framed as an operational fallback step inside an automation skill, making unsafe execution more likely during troubleshooting.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger description is extremely broad: it instructs the agent to use this skill for ANY Slack Bot request and instead of calling the API directly. That can cause unintended invocation for loosely related Slack tasks, increasing the chance of over-privileged tool use or accidental state-changing operations without selecting a narrower, task-specific path.

Static analysis

No suspicious patterns detected.