Agility CMS

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:43 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent read-only Agility CMS helper, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the first-time setup before installing. Prefer installing the oo CLI through a verified package or documented manual process, and do not pipe remote scripts directly into bash or PowerShell unless you trust the publisher and accept the local execution risk. For normal use after setup, the skill appears limited to Agility CMS read actions through the oo connector.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installation Scripts Are Executed Directly## Vulnerability Details **File Location**: `SKILL.md:60-64` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from external URLs and immediately pass them to local command interpreters. Neither command pins a particular script version, verifies a cryptographic hash or signature, saves the script for inspection, nor confirms its contents with the user before execution. HTTPS protects the connection in transit but does not establish that the current script is identical to the version reviewed with this Skill. Compromise of the hosting service, its deployment pipeline, DNS or certificate infrastructure, or the publisher account could change the effective payload after review. The Windows command is the direct PowerShell equivalent of the Unix `curl | bash` pattern and has the same trust-boundary problem. Although installation is presented as conditional on the CLI being absent, arbitrary remote code execution is not necessary for the Skill's declared read-only Agility CMS functionality and exceeds minimum privilege. ### Attack Path 1. The `oo` CLI is missing, or an attacker causes the command lookup to fail. 2. The Agent or user follows the documented first-time setup procedure. 3. The external installation endpoint, hosting infrastructure, or publishing pipeline has been compromised or serves an unexpectedly changed script. 4. `curl` or `Invoke-RestMethod` retrieves the attacker-controlled content. 5. The pipe sends that content directly to Bash or `Invoke-Expression` without integrity verification or inspection. 6. The payload executes with all permissions available to the invoking Agent or user. ### Impact Assessment Successful e ...[truncated 558 chars]
• Remediation: ## Remediation Suggestions - Remove both direct download-to-interpreter pipelines. - Prefer installation through a trusted operating-system package manager or a pinned release artifact from a verified publisher. - Pin the installer or package to an explicit version rather than retrieving mutable latest content. - Publish cryptographic checksums and signed release metadata through an independently authenticated channel. - Download the artifact to disk, verify its signature and checksum, and only then permit execution. - Present the verified installer and its intended effects to the user and require explicit approval before running it. - Do not allow the Skill to install software automatically; direct users to reviewed manual installation documentation instead. - Run any necessary installer with ordinary user privileges and avoid privilege elevation unless a specific operation demonstrably requires it. - Document expected files, network destinations, and system changes so users can assess the installation's scope.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 95% confidence
• Finding: The skill includes a one-line install command that fetches a remote script and pipes it directly to bash, which enables arbitrary code execution if the remote server, transport, or distribution path is compromised. In a skill context, this is especially risky because it may normalize or automate unsafe bootstrap behavior during error recovery, causing users or agents to run unverified code.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Agility CMS request" and "Whenever a task involves Agility CMS," which is an extremely broad activation condition. It lacks scope boundaries or exclusion examples, increasing the chance of unintended invocation for routine mentions or loosely related tasks.

Static analysis

No suspicious patterns detected.