Airbrake

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:18 AM UTC
• Version: 1.0.2

Overview

This Airbrake skill mostly matches its purpose, but its setup instructions tell users to execute unverified remote installer scripts, so it needs review before installation.

Review this skill before installing. Do not let an agent automatically run the pipe-to-shell installer commands; install the oo CLI only through a trusted, reviewed method and verify what will run locally. Use a least-privilege Airbrake API key, review connector schemas and payloads before any write-like action, and treat the `get_deploy` safety tag as ambiguous until corrected.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 62–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download mutable content from external URLs and immediately execute it using Bash or PowerShell. They do not pin an installer version, verify a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded file before execution. Although the URLs use HTTPS and appear associated with the declared OOMOL service, HTTPS alone does not establish the integrity of the scripts over time. A compromise of the hosting infrastructure, distribution account, DNS or TLS trust chain, or the remote scripts themselves could turn these documented commands into arbitrary code-execution channels. The effective code executed by the Skill user can therefore change after this Skill has been reviewed. Installation is presented only as a fallback when `oo` is unavailable, which reduces how frequently the commands may run. However, installing the CLI is not required for every Airbrake action, and immediate execution of an unverified remote script exceeds the minimum privileges and trust necessary to provide installation guidance. ### Attack Path 1. The Agent or user attempts an Airbrake operation and receives an `oo: command not found` error. 2. The first-time setup instructions direct the Agent or user to one of the remote installer commands. 3. An attacker compromises or gains control over the installer content or its delivery path. 4. `curl` or `irm` retrieves the attacker-controlled content without artifact-level integrity verification. 5. The pipeline passes that content directly to Bash or PowerShell. 6. The malicious payload executes w ...[truncated 845 chars]
• Remediation: ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` execution patterns. 2. Prefer a trusted operating-system package manager or a version-pinned installer published through an authenticated release channel. 3. If a standalone installer is necessary, download it to a local file without executing it immediately. 4. Pin an explicit release version and publish its expected SHA-256 or stronger cryptographic digest through a separately protected channel. 5. Verify the digest and, where supported, a detached signature from a documented vendor signing key before execution. 6. Allow the installer contents to be reviewed before running them. 7. Execute installation with the least-privileged account possible and request elevation only for narrowly defined operations that require it. 8. Document the exact files, directories, network endpoints, and permissions used by the installer. 9. For automated Agent use, instruct the Agent to report the missing CLI and request explicit user approval rather than automatically downloading and executing installation code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: `curl ... | bash` is a classic unsafe pattern that executes remote content immediately with no verification, sandboxing, or opportunity for inspection. In the context of an agent skill, this is more dangerous because the skill operationalizes the command as a troubleshooting step, increasing the chance that users or automation will run it reflexively.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The instruction to use this skill for ANY Airbrake request is overly broad and can steer agents to invoke the skill indiscriminately without evaluating whether a narrower, safer, or more appropriate path exists. Broad routing language increases blast radius if the skill documentation is inaccurate, the connector is overprivileged, or future write actions are added.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill contradicts itself by labeling `get_deploy` as `[write]` while later stating that `get` actions are reads. In an automation context, inaccurate safety labeling can cause an agent or user to make the wrong trust decision, either adding unnecessary friction or, more importantly, normalizing unreliable action classifications that could hide truly state-changing operations in similar skills.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The first-time setup section instructs users to pipe remote scripts directly into a shell or PowerShell session without warning or integrity verification. This creates a direct arbitrary-code-execution path if the install endpoint, transport, hosting, or supply chain is compromised, and it is especially risky in a skill because an agent may present or execute the step as a normal recovery action.

Static analysis

No suspicious patterns detected.