AgentMail

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.4

Overview

This AgentMail skill is mostly purpose-aligned, but its fallback setup tells agents to execute remote installer scripts directly, which is too risky without explicit user approval or verification.

Review this skill before installing. It can operate and modify AgentMail resources, including sending messages, managing API keys, webhooks, domains, inboxes, and deleting data. Only use it if you trust OOMOL and AgentMail access from this environment, and do not let an agent run the documented installer commands unless you have independently verified the installer source and intentionally approve the installation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:156
• Finding: Unverified Remote Installer Download and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 156–160 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from an external service and immediately execute them through `bash` or PowerShell `Invoke-Expression`. Neither installation method pins a release, verifies a cryptographic checksum, validates a publisher signature, nor gives the user an opportunity to inspect the downloaded content before execution. HTTPS protects the connection in transit but does not guarantee that the current remote script is the same code that was reviewed. Compromise of the hosting service, publishing account, DNS or certificate trust chain, or installer deployment process could therefore substitute arbitrary code. Although installation is only suggested after an `oo: command not found` error, installing software is not necessary to the Skill's normal operation when the CLI is already present. Automatically following this fallback would exceed the minimum privileges needed merely to invoke the AgentMail connector. ### Attack Path 1. The Agent attempts to use the Skill on a system where the `oo` CLI is absent. 2. The command fails with `oo: command not found`. 3. The Agent follows the documented first-time setup command. 4. `curl` or `irm` downloads the current script from the external OOMOL endpoint. 5. The shell executes the response immediately without integrity or authenticity verification. 6. If the endpoint or delivery chain has been compromised, attacker-controlled commands execute with the privileges of the user running the Agent. 7. The payload can access files and credentials available to that user, alter local tools, install addition ...[truncated 671 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the pipe-to-shell and `Invoke-Expression` installation commands from autonomous Skill instructions. 2. Direct users to an official, reviewed package-manager release or a version-pinned downloadable artifact. 3. Download the installer as a separate file rather than executing an HTTP response directly. 4. Publish and verify a SHA-256 or stronger cryptographic digest over the exact versioned artifact. 5. Verify a platform-appropriate publisher signature before execution. 6. Present the resolved version, source URL, expected digest, installation scope, and requested privileges to the user. 7. Require explicit user approval before installing or executing the downloaded artifact. 8. Run installation without administrative privileges unless a documented component strictly requires elevation. 9. Prefer sandboxed or isolated installation where practical. 10. Fail safely if signature or checksum validation cannot be completed; do not fall back to unverified execution. A safer workflow is: select a pinned release, download it to a local file, verify its signature and published digest, allow review, and execute it only after explicit approval. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software using a remote script piped directly to a shell, which is a classic supply-chain and arbitrary code execution risk. Because skill content is treated as operational guidance, an agent following this path could execute unreviewed code from the network on the host environment if `oo` is missing.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says to use this skill for "ANY AgentMail request" and "Whenever a task involves AgentMail," which is a very broad activation condition for a markdown skill file. It does not define clear boundaries, exclusions, or negative examples for when the skill should not be invoked, increasing the chance of unintended activation.

Static analysis

No suspicious patterns detected.