AeroLeads

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:06 AM UTC
• Version: 1.0.3

Overview

This is a coherent AeroLeads connector, but its setup instructions tell users to execute an unverified internet installer directly.

Review the setup path before installing. Prefer installing the oo CLI through a pinned, verifiable release or a package manager with integrity checks, and only connect AeroLeads credentials to OOMOL if you are comfortable with that service brokering connector access to prospect data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Unverified Remote Installer Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions pipe remotely downloaded content directly into a command interpreter. Neither installation path pins the installer to an immutable version nor verifies a cryptographic signature or checksum before execution. Consequently, the effective code executed by these commands can change after the Skill has been reviewed. Compromise of the hosting infrastructure, DNS or delivery chain, or the publisher account could cause arbitrary replacement content to execute immediately. HTTPS protects the connection in transit under normal conditions, but it does not establish that the retrieved script is an audited, immutable release. Installing the `oo` CLI is relevant to the Skill's declared AeroLeads functionality. However, immediate execution of an unverified remote script exceeds the minimum safe mechanism necessary to install that dependency. A user can instead download a pinned release, verify its provenance and integrity, and install it separately. The audit did not establish that the current remote installers are malicious. The confirmed vulnerability is the mutable and unverified remote code-execution channel created by the documented commands. ### Attack Path 1. The `oo` command is unavailable, and the user or agent follows the first-time setup instructions. 2. The shell requests `install.sh` or `install.ps1` from the external OOMOL endpoint. 3. An attacker who compromises the endpoint, its publishing process, or another trusted delivery component substitutes a malicious installer. 4. Because the response is passed directly to `bash` or `iex`, no local r ...[truncated 1170 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both download-to-interpreter pipelines from the setup instructions. 2. Direct users to an official package manager or a version-pinned release hosted in a verifiable official repository. 3. Download the installer or binary to a local file without executing it: ```bash curl --fail --show-error --location --output oo-install.sh \ "https://example.invalid/releases/vX.Y.Z/install.sh" ``` 4. Publish and verify a SHA-256 or stronger checksum over a trusted, separately authenticated channel: ```bash echo "<expected-sha256> oo-install.sh" | sha256sum --check - ``` 5. Prefer cryptographic release signatures and validate the signing key through an independently documented trust path. 6. Allow the user to inspect the downloaded installer before explicitly invoking it. 7. Pin the CLI version so that the reviewed dependency cannot change silently. 8. Avoid requesting administrator privileges unless a documented installation step strictly requires them; prefer a user-scoped installation. 9. For Windows, replace `irm ... | iex` with separate download, signature or hash verification, and explicit execution steps. 10. Document the domains contacted, files created, expected installation location, and permissions required by the installer. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 96% confidence
• Finding: The skill recommends installing software by piping a remote script directly into a shell (`curl ... | bash`), which executes code from the network without prior verification. If the remote host, transport, or installer is compromised, this can lead to arbitrary code execution on the agent host or user environment.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger language is overly broad and instructs the agent to use this skill for essentially any AeroLeads-related task, which can cause the skill to be invoked in loosely related contexts without adequate narrowing. In a security-sensitive environment, broad routing increases the chance that an agent follows the skill's operational instructions, including setup and external command guidance, when a more limited or safer handling path would be appropriate.

Static analysis

No suspicious patterns detected.