Security audit

A-Leads

Security checks for vulnerabilities and agentic risk

Overview

The A-Leads connector is purpose-aligned, but its first-time setup tells users to execute live remote installer scripts without verification.

Review this skill before installing. Its normal A-Leads connector calls are scoped to the oo CLI, but do not run the provided curl | bash or irm | iex installer commands unless you independently trust and verify the OOMOL installer and understand the local changes it will make. Treat personal email and phone lookups as sensitive data access and run them only for appropriate, user-approved lead-enrichment tasks.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:58
Finding: Unverified Remote Shell Script Download and Execution
Content: View full analysis
Remediation: View remediation
install.sh" | sha256sum --check - # Inspect install.sh and obtain explicit approval before execution. bash install.sh ``` The real implementation must use a digest or signature published by the legitimate vendor through an authenticated, independently verifiable channel. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:62
Finding: Unverified Remote PowerShell Script Download and Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs the agent to execute a remote script directly via 'curl | bash', which is a classic arbitrary code execution pattern. If the remote host, transport, or script content is compromised, the agent could run attacker-controlled code on the local system with the user's privileges.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to use this skill for 'ANY A-Leads request' is an overly broad routing trigger that can override more specific policy checks or safer alternatives. Broad activation language increases the chance the agent will invoke the skill in inappropriate contexts, including sensitive lead-enrichment requests involving personal data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is presented as a read/search interface to A-Leads, but its setup flow instructs the agent to perform environment-changing actions such as installing software and initiating authentication. That expands the skill's operational scope beyond passive data access and can cause the agent to take privileged local actions a user may not expect from a 'read-only' skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: L47 states that untagged actions are 'reads (get / list / search) — safe to run directly.' But the available actions at L40-L43 are find_* and verify_email, which are not presented as simple get/list/search operations and may invoke external enrichment/verification behavior. This documentation overstates their alignment with basic read-only semantics.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.