Accredible Certificates

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:58 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for managing Accredible certificates, but its setup instructions include unverified remote installer commands that can execute code on the user's machine.

Review the setup path before installing. Use this skill only if you trust OOMOL and Accredible access through the connector, and avoid running the remote installer commands unless you can verify the installer source or install the oo CLI through a safer trusted package or signed release path. Confirm all create and delete actions before they run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Installer Download and Immediate Shell Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 62–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The documented installation procedures retrieve mutable scripts from an external server and immediately execute them through Bash or PowerShell. Neither procedure pins a reviewed release, verifies a cryptographic digest or publisher signature, nor provides an inspection boundary between downloading and execution. The installation source is related to the declared OOMOL integration, and installing the CLI may be necessary when it is absent. However, direct download-and-execute behavior exceeds the minimum privileges and safeguards necessary to install the dependency. The effective code is controlled remotely and can change after the Skill has been reviewed. A compromise of the hosting infrastructure, publishing account, DNS or TLS termination environment, or installer delivery pipeline could replace the installer with arbitrary commands. The downloaded script would then execute with all privileges available to the user or agent running the documented command. The Skill also legitimately transmits Accredible action payloads through the disclosed OOMOL connector. No evidence in the reviewed file establishes that this connector traffic is sent to an unrelated endpoint, so that behavior is not reported as a separate vulnerability. ### Attack Path 1. The `oo` CLI is unavailable and the command fails with `oo: command not found`. 2. The user or agent follows the fallback installation instructions in `SKILL.md`. 3. Bash or PowerShell retrieves the current installer from `cli.oomol.com`. 4. The response body is passed directly to a command interpreter without integrity or authentici ...[truncated 1150 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct execution pipelines (`curl | bash` and `irm | iex`). 2. Pin installation instructions to a specific, reviewed CLI release rather than a mutable installer endpoint. 3. Download the installation artifact to a local file without executing it. 4. Verify a hard-coded cryptographic digest and, preferably, a publisher signature using a separately trusted verification key. 5. Execute the artifact only after successful verification, using a separate explicit command. 6. Prefer signed operating-system package repositories or signed release packages with version pinning. 7. Document the expected publisher, version, digest, destination paths, and permissions before installation. 8. Do not request administrator or root privileges unless a specific installation step demonstrably requires them. 9. Configure automation to stop on verification failure and never fall back to executing an unverified download. 10. For agent-driven use, require explicit user approval before installing software or running any downloaded executable content. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remote script directly into a shell (`curl ... | bash`). This pattern allows arbitrary code execution if the remote host, transport, distribution path, or install script is compromised, and the skill context increases danger because it presents the command as a sanctioned remediation step during normal operation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Accredible Certificates request" and "Whenever a task involves Accredible Certificates," which is very broad and lacks boundaries or exclusion conditions. In a manifest file, this can cause unintended invocation for loosely related mentions of Accredible Certificates rather than clearly scoped actions.

Static analysis

No suspicious patterns detected.