Affinda

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:17 AM UTC
• Version: 1.0.3

Overview

The skill is a coherent Affinda connector, but its first-time setup tells the agent to run an unverified remote installer directly in the shell.

Review this skill before installing. The Affinda operations are clearly described, but do not let an agent run the documented remote installer automatically; install the oo CLI through a verified, versioned, or inspected method first, then use the skill only for Affinda actions you intend to perform, especially uploads or other write actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installer Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 60–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute the responses using Bash or PowerShell. The scripts are not version-pinned, inspected, or verified against a cryptographic signature or known checksum. HTTPS protects the connection in transit when correctly implemented, but it does not make the remote payload immutable. Compromise of the distribution server, its deployment pipeline, DNS or certificate infrastructure, or the scripts themselves could cause arbitrary attacker-controlled code to run. The effective executable payload is external to the reviewed project and may change after this audit. Installing the `oo` CLI supports the declared Affinda connector functionality. However, passing an unverified network response directly to an interpreter exceeds the minimum safe mechanism needed for installation. ### Attack Path 1. The `oo` command is unavailable on the user's system. 2. The user or agent follows the documented first-time setup procedure. 3. The system retrieves `install.sh` or `install.ps1` from the remote server. 4. A compromised server or software supply chain returns a modified installer. 5. The response is passed directly to Bash or PowerShell without validation. 6. The malicious installer executes with the permissions of the invoking user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. The resulting access may include: - Reading or modifying files accessible to that user. - Accessing local application data and credentials available to ...[truncated 702 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace direct remote-to-interpreter pipelines with installation from a trusted, version-pinned package repository or release artifact. 2. Download the installer or binary to a local file before execution so it can be inspected. 3. Publish a cryptographic checksum for each fixed release and verify it before running or installing the artifact. 4. Prefer signed binaries or packages and require signature validation against a documented publisher key. 5. Pin the installer to an immutable release version rather than a mutable `install.sh` or `install.ps1` endpoint. 6. Abort installation if checksum or signature verification fails. 7. Advise users to install with ordinary user permissions and avoid unnecessary administrative or root execution. 8. Document the files, commands, network endpoints, and permission changes expected from the installer. 9. If scripted installation remains necessary, use a safer sequence such as download, verification, review, and explicit execution rather than `curl | bash` or `irm | iex`. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell, which executes code fetched over the network without prior verification. If the install endpoint, transport path, or hosting account is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The description says to use this skill for ANY Affinda request and instead of calling the API directly, which is an overly broad trigger that can cause the agent to invoke the skill in many contexts without narrow scoping or user-intent checks. In a connector skill that can both read and write data, this broad invocation language increases the chance of unintended data access or state-changing operations being routed through the skill.

Static analysis

No suspicious patterns detected.