7shifts

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:17 AM UTC
• Version: 1.0.2

Overview

The skill’s 7shifts connector behavior is mostly coherent, but its fallback setup tells agents to execute remote installer scripts directly, which creates a review-worthy supply-chain risk.

Review the installer step before using this skill. The 7shifts read actions are disclosed and narrow, but you should not let an agent run the provided curl | bash or irm | iex setup commands automatically; install the oo CLI only from a verified source and confirm the connected 7shifts account and requested data scope.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable script from an external URL and pipes it directly into `bash`. The downloaded payload is neither pinned to a specific release nor validated with a cryptographic hash or trusted signature. Consequently, the code ultimately executed can change after the Skill has been reviewed. HTTPS provides transport protection but does not establish payload immutability or protect against compromise of the remote domain, hosting account, release pipeline, or signing infrastructure. The shell receives the remote response as executable input without giving the user or Agent an opportunity to inspect it. Installing the CLI may be relevant to the declared connector functionality, but executing an unrestricted remote response exceeds the minimum privilege necessary. A version-pinned package or independently verified artifact would provide the required installation functionality with substantially less supply-chain risk. ### Attack Path 1. An attacker compromises `cli.oomol.com`, its hosting environment, DNS path, deployment pipeline, or installer source. 2. The attacker modifies `install.sh` to contain malicious shell commands. 3. The `oo` command is unavailable, causing the documented first-time setup instructions to be used. 4. `curl` retrieves the attacker-controlled response. 5. The pipe sends that response directly to `bash`. 6. The payload executes with the privileges of the user or Agent running the command. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking account. Depending on that account's permissions, an attacker could read or alter ac ...[truncated 469 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pipeline. - Pin installation instructions to a specific, reviewed CLI release. - Prefer an official operating-system package manager or a signed release artifact. - Download the installer or binary as a separate step rather than executing the network response directly. - Publish an expected SHA-256 digest or a verifiable digital signature through an independent trusted channel. - Verify the digest or signature before execution and abort on any mismatch. - Display the exact version and source to the user and require explicit user approval before installation. - Run installation with ordinary user privileges and avoid requesting administrative privileges unless a documented component strictly requires them.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 65 **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: Critical **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable PowerShell script and forwards the response directly to `Invoke-Expression` (`iex`). `Invoke-Expression` interprets the remote response as PowerShell code without version pinning, checksum validation, signature verification, or prior inspection. The effective payload is controlled by external infrastructure and may change independently of the audited Skill. Although installing the `oo` CLI supports the declared functionality, unrestricted execution of a mutable remote response is broader than necessary and creates a high-impact supply-chain execution channel. ### Attack Path 1. An attacker compromises `cli.oomol.com`, its hosting environment, DNS path, deployment pipeline, or installer source. 2. The attacker replaces or alters `install.ps1` with malicious PowerShell instructions. 3. A Windows user or Agent encounters an unavailable `oo` command and follows the first-time setup guidance. 4. `Invoke-RestMethod` downloads the attacker-controlled script. 5. The pipeline passes the response directly to `Invoke-Expression`. 6. PowerShell executes the payload with the privileges and accessible resources of the invoking process. ### Impact Assessment Successful exploitation permits arbitrary PowerShell command execution under the invoking account. Potential consequences include theft of accessible credentials and files, modification of user configuration, downloading and launching additional payloads, access to authenticated services, and persistence mechanisms if the account has sufficient permissions. The audited project do ...[truncated 240 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern. - Pin the CLI to a specific reviewed release rather than a mutable installer endpoint. - Prefer a signed Windows package, such as a verified MSI or package-manager distribution. - Download the artifact separately and verify its Authenticode signature and publisher identity before execution. - Publish and verify a cryptographic digest through an independent trusted channel. - Reject unsigned artifacts, unexpected publishers, digest mismatches, and redirected downloads. - Require explicit user approval before installation and clearly disclose the exact version and destination. - Avoid elevated PowerShell sessions unless installation genuinely requires administrative privileges.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

## Available actions

- `get_company` — Retrieve one 7shifts company by ID.
- `list_companies` — List 7shifts companies available to the access token.
- `list_departments` — List 7shifts departments for a company.
- `list_locations` — List 7shifts locations for a company.
- `list_roles` — List 7shifts roles for a company.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Available actions

- `get_company` — Retrieve one 7shifts company by ID.
- `list_companies` — List 7shifts companies available to the access token.
- `list_departments` — List 7shifts departments for a company.
- `list_locations` — List 7shifts locations for a company.
- `list_roles` — List 7shifts roles for a company.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill recommends installing software via a remote script piped directly into a shell (`curl ... | bash`), which executes network-fetched code without prior verification. In an agent skill context, this is especially dangerous because fallback setup steps may be followed automatically or with limited scrutiny, creating a supply-chain and arbitrary code execution risk on the host.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger text is extremely broad: 'Use this skill for ANY 7shifts request' and 'Whenever a task involves 7shifts, use this skill instead of calling the API directly.' This can cause over-invocation of the skill for loosely related mentions of 7shifts, increasing the chance of unnecessary data access or actions being routed through the connector without sufficient task scoping.

Static analysis

No suspicious patterns detected.