Aimfox

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:07 AM UTC
• Version: 1.0.3

Overview

This Aimfox skill is mostly coherent, but its setup instructions tell users to run unverified remote installer scripts directly in a shell.

Before installing, avoid running the remote installer commands as written unless you trust and have verified the OOMOL installer source. Prefer a pinned or signed oo CLI installation path, and require explicit confirmation before any Aimfox write or destructive action runs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 65-69 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download mutable content from external URLs and immediately interpret it with Bash or PowerShell. Neither command pins a specific release nor verifies a cryptographic checksum or signature before execution. Consequently, the code that executes can differ from the content available when the Skill was audited. HTTPS protects the connection in transit but does not make the remote payload immutable and does not mitigate compromise of the hosting service, deployment infrastructure, DNS/account controls, or installer publishing process. The PowerShell `Invoke-Expression` (`iex`) pattern and the Bash pipe both provide the downloaded response with a general-purpose code-execution channel. Installing the `oo` CLI is relevant to the declared Aimfox functionality, but direct, unrestricted shell execution exceeds the minimum privileges necessary to obtain a known CLI release. A verified, version-pinned package or binary would provide a narrower and auditable installation path. ### Attack Path 1. The `oo` command is unavailable, causing the documented first-time setup condition to apply. 2. The user or agent runs the provided Bash or PowerShell installation command. 3. The command retrieves the current response from the OOMOL installation endpoint. 4. The response is passed directly to `bash` or `iex` without inspection, version pinning, checksum validation, or signature verification. 5. If the endpoint or its publishing infrastructure serves a modified payload, that payload executes immediately with the permissions of the invoking process. 6. The payload ...[truncated 821 chars]
• Remediation: ## Remediation Suggestions 1. Remove all pipe-to-shell and download-to-`Invoke-Expression` installation instructions. 2. Pin installation instructions to a specific, immutable CLI version from the official release repository. 3. Download the installer, package, or binary to a local file without executing it automatically. 4. Publish a cryptographic SHA-256 or stronger checksum through an independently protected channel and verify it before installation. 5. Prefer signed packages or binaries and verify the publisher signature using a pinned, documented public key. 6. Show the resolved version, source URL, checksum result, and intended installation location before requesting explicit user approval. 7. Run installation without elevated privileges unless a clearly documented operation strictly requires elevation. 8. Where supported, use a trusted platform package manager with version pinning and signature verification instead of a general-purpose shell script.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill recommends installing software by piping a remote script directly into a shell (`curl ... | bash`), which executes unverified code fetched at runtime. If the hosting source, transport, CDN, or install script is compromised, the user could execute arbitrary commands on their system, making this particularly dangerous in an agent skill that may normalize command execution guidance.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger text instructs use of this skill for "ANY Aimfox request," which is overly broad and can cause the agent to invoke the skill for loosely related or ambiguous Aimfox mentions without narrower task scoping. Because the skill supports read, write, and destructive actions, broad invocation increases the chance of unnecessary connector access and raises the risk of unintended state-changing operations if downstream confirmation logic fails or is bypassed.

Static analysis

No suspicious patterns detected.