AITable

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

The AITable skill is mostly purpose-aligned, but its setup instructions include unverified remote installer scripts that could execute arbitrary code on a user's machine.

Review this skill before installing. It is appropriate for managing AITable through OOMOL, but avoid running the curl-to-bash or irm-to-iex installer commands unless you independently trust and verify the installer source; install the oo CLI through a safer documented, pinned, or signed method where available. Confirm all create, update, and delete payloads before allowing the agent to run them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Execution on macOS and Linux<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a mutable shell script from an external URL and pipes it directly into `bash`. The script is executed without: - Pinning an installer or CLI version - Verifying a published cryptographic hash - Validating a digital signature - Saving the script for inspection - Restricting the script through a sandbox or reduced-privilege account HTTPS protects the connection in transit but does not establish that the returned script is a reviewed, immutable artifact. Compromise of the hosting service, publishing account, DNS infrastructure, or installer build pipeline could cause arbitrary attacker-controlled commands to be returned and executed. Installing the CLI is relevant when `oo` is unavailable, but direct execution of an unverified remote response exceeds the minimum privileges necessary. A package manager or a downloaded, pinned, and independently verified release could provide the required functionality without granting a mutable endpoint immediate shell execution. ### Attack Path 1. The user or agent attempts to use the Skill on a system where the `oo` CLI is not installed. 2. The command fails with `oo: command not found`. 3. The fallback instructions direct the installer command to be run. 4. An attacker compromises or otherwise controls the response from `https://cli.oomol.com/install.sh`. 5. `curl` retrieves the attacker-controlled response. 6. The pipe sends the response directly to `bash` without integrity verification or review. 7. The payload executes with the privileges of the account running the command. ### Impact Assessment Successful exploitation provides arbitrary command execution with the invoking user's privileges. ...[truncated 727 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` installation command. 2. Prefer an official package manager that supports version pinning and package-signature validation. 3. If a standalone installer is necessary: - Download a specific, immutable release to a local file. - Pin the expected CLI version. - Publish the expected SHA-256 digest through an independently protected channel. - Verify the digest before execution. - Verify a digital signature from a documented release key. - Display or otherwise make the installer available for review before running it. 4. Require explicit user approval before installation; the agent should not install software automatically after a failed action. 5. Run installation with ordinary user privileges unless a documented component strictly requires elevation. 6. Document the files, permissions, and network endpoints used by the installer. 7. Where possible, instruct users to install the CLI outside the agent session and then retry the connector action. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Execution on Windows<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The PowerShell instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable script from an external server and passes the response directly to `Invoke-Expression` (`iex`). `Invoke-Expression` interprets the downloaded text as PowerShell code in the current process. No version pinning, checksum validation, signature verification, local review step, or execution isolation is present. Therefore, the effective code executed on a Windows host can change after the Skill itself has been reviewed. TLS does not mitigate compromise of the legitimate server, release pipeline, publishing credentials, or other trusted infrastructure. Installation is needed only when the CLI is absent. Executing an unverified network response through `iex` is not the least-privileged or least-trust installation method and unnecessarily exposes the entire PowerShell session to the remote endpoint. ### Attack Path 1. The user or agent invokes the Skill on a Windows host without the `oo` CLI installed. 2. The initial connector command fails because `oo` cannot be found. 3. The fallback documentation prompts execution of the PowerShell installer command. 4. An attacker compromises or controls the content served by `https://cli.oomol.com/install.ps1`. 5. `Invoke-RestMethod` downloads the malicious PowerShell content. 6. The pipeline passes that content directly to `Invoke-Expression`. 7. PowerShell executes the payload under the current user's security context without cryptographic integrity validation. ### Impact Assessment The remote response receives arbitrary PowerShell execution capability with the privileges of the invoking account. Potential consequences include: - Theft of ...[truncated 675 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `irm ... | iex` pattern. 2. Prefer a signed Windows package, such as a version-pinned installer distributed through a trusted package-management channel. 3. If PowerShell-based installation remains necessary: - Download a specific release to a local `.ps1` file. - Pin the installer and CLI version. - Validate an Authenticode signature from a documented trusted publisher. - Verify a separately published SHA-256 digest. - Stop installation if either verification fails. - Permit inspection of the downloaded script before execution. 4. Require explicit user approval before executing the verified installer. 5. Do not request administrator privileges unless the installation design documents a strict need for them. 6. Avoid bypassing PowerShell execution policy or disabling endpoint-security controls. 7. Document expected filesystem changes, subprocesses, requested privileges, and network destinations. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into bash. This is dangerous because it executes unverified code from the network immediately, enabling supply-chain compromise, man-in-the-middle abuse, or malicious upstream changes to achieve arbitrary code execution on the host.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY AITable request," which is an overly broad routing trigger that can cause the agent to invoke this skill in many contexts without sufficient narrowing or user-intent checks. Because the skill includes write and destructive operations, broad automatic invocation increases the chance of unintended data modification or deletion, especially if the agent overgeneralizes ambiguous requests.

Static analysis

No suspicious patterns detected.