Nummo

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:37 AM UTC
• Version: 0.1.8

Overview

This financial-data skill is coherent, but its install instructions use an unverified remote shell installer before a CLI that handles bank-account access.

Review the installer carefully before installing. Prefer a versioned release, checksum or signature verification, or a download-then-inspect flow. Only connect bank accounts if you trust Nummo and are comfortable granting the CLI access to account and transaction data through Plaid.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: reference/install.md:3
• Finding: Unverified Remote Installer Executed Directly by Shell## Vulnerability Details **File Location**: `reference/install.md`, line 3 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```sh curl -fsSL https://nummo.ai/install | sh ``` ### Technical Analysis The installation command retrieves a script from an external URL and pipes the response directly into `sh`. The downloaded script is not present in the audited project and therefore cannot be statically inspected. Its behavior can also change after this Skill has been reviewed. The command does not pin an installer version, validate a cryptographic checksum, or verify a digital signature. Although HTTPS protects the connection in transit under normal conditions, it does not protect users if the domain, hosting environment, deployment process, or installer itself is compromised. Installing the CLI is relevant to the Skill's declared functionality, but executing an unverified and mutable server response is not the minimum privilege or minimum trust mechanism necessary to perform that installation. ### Attack Path 1. A user follows the installation instructions in `reference/install.md`. 2. The user's shell requests the current response from `https://nummo.ai/install`. 3. An attacker who has compromised the domain, hosting infrastructure, TLS termination, deployment pipeline, or installer content substitutes malicious shell commands. 4. Because the response is piped directly to `sh`, those commands execute immediately without an inspection or integrity-verification step. 5. The payload operates with the permissions of the user running the command and can access resources available to that account. ### Impact Assessment Successful exploitation provides arbitrary shell-command execution with the invoking user's privileges. Depending on those privileges and the remote payload, this may permit filesystem modification, credential or session-token theft, financial-data expos ...[truncated 432 chars]
• Remediation: ## Remediation Suggestions 1. Replace the direct `curl | sh` pipeline with a download-first installation process that allows inspection before execution. 2. Publish immutable, versioned release artifacts from a documented official release repository. 3. Pin the requested CLI version and platform-specific artifact rather than using a mutable installer endpoint. 4. Publish SHA-256 checksums over an independently protected channel and require checksum validation before installation. 5. Prefer digitally signed release artifacts and document signature verification using a pinned public key. 6. Make the complete installer source available for audit and clearly document every file, permission, and path it modifies. 7. Avoid requiring elevated privileges. Install into a user-controlled directory unless a system-wide installation is explicitly requested and justified. 8. If an installer script remains necessary, download it to a local file, verify its integrity and signature, allow the user to inspect it, and only then execute it.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

External Script Fetching

High

• Category: Supply Chain

Content

Run this command to install the CLI binary:

curl -fsSL https://nummo.ai/install | sh

• Confidence: 99% confidence
• Finding: `curl -fsSL https://nummo.ai/install | sh` causes immediate execution of code retrieved from an external endpoint, giving that endpoint full control over what runs locally at install time. In the context of a banking-related agent skill, this is especially sensitive because compromise of the installer could lead to credential theft, persistence, or tampering on systems likely to handle financial data.

Chaining Abuse

High

• Category: Tool Misuse

Content

Run this command to install the CLI binary:

curl -fsSL https://nummo.ai/install | sh

• Confidence: 98% confidence
• Finding: The `| sh` pipeline removes any inspection boundary and turns network content directly into shell commands, which is a classic command-chaining abuse pattern. Any malicious or unintended change in the fetched content would execute immediately, making exploitation straightforward and high impact.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Guidelines

- Always ask for permission before calling any tool. This skill gives you read access to financial data, and you must get explicit consent from the user.
- If no date range is mentioned, use the command defaults — don't ask the user for dates.
- Use `summary` by default when the user asks broad questions about their finances. - Use `txs` for specific lookups or drill-downs.
- When a command returns a URL (connect, checkout, change), always present it clearly and tell the user to open it in their browser.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation instructs users to fetch a remote script over the network and immediately execute it with the shell, without any verification, pinning, or warning. This creates a supply-chain execution path where compromise of the vendor site, CDN, DNS, TLS termination, or the install script itself would result in arbitrary code execution on the user's machine.

Static analysis

No suspicious patterns detected.