Amplemarket

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:32 AM UTC
• Version: 1.0.2

Overview

The skill fits its Amplemarket purpose, but it should be reviewed because setup uses unverified remote install scripts and one state-changing task action is not clearly gated for confirmation.

Install only if you are comfortable with OOMOL managing the Amplemarket connection and with agents running `oo` connector actions. Treat setup commands as sensitive: inspect or verify the installer before running it, and require explicit confirmation for task-changing actions, including `skip_task`.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote Installation Scripts Are Executed Directly by a Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 65–69 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and execute them immediately using `bash` or PowerShell `Invoke-Expression`. Neither command pins a script version, verifies a cryptographic checksum or digital signature, nor saves the downloaded content for inspection before execution. This creates a remote code-execution channel whose effective payload can change after the Skill has been reviewed. Although installing the OOMOL CLI supports the declared Amplemarket connector functionality and the download domain corresponds to the stated vendor, direct download-to-shell execution is not the minimum privilege or safest mechanism necessary to install a client. Trust in the Skill package is effectively extended to the remote server, its deployment pipeline, and its future content. The Unix command also uses `curl -f`, which detects HTTP errors, but this does not validate the authenticity or integrity of a successfully returned script. HTTPS protects transport in normal circumstances but does not protect against compromise of the remote service or its publishing infrastructure. The PowerShell form has the same underlying problem because `irm` retrieves the content and `iex` interprets it directly as code. ### Attack Path 1. The `oo` command is unavailable and the user follows the documented first-time setup procedure. 2. An attacker compromises the remote installation endpoint, its publishing pipeline, or another component capable of controlling the script served from the documented URL. 3. The endpoint returns an altered installation script. 4. `ba ...[truncated 1238 chars]
• Remediation: ## Remediation Suggestions 1. Replace pipe-to-shell installation with a version-pinned package distributed through a trusted operating-system package manager or an official release artifact. 2. Publish cryptographic checksums and, preferably, digitally signed release artifacts. Require signature or checksum verification before execution. 3. Download the installer to a local file rather than piping it directly into a shell, for example: - Download a specific, immutable release. - Verify its expected SHA-256 checksum or vendor signature. - Stop installation if verification fails. - Execute the verified local file only after allowing inspection. 4. Avoid PowerShell `Invoke-Expression` for remotely retrieved content. Use a signed installer package or a verified local script instead. 5. Document that installation must be performed without administrative privileges unless a specific, justified step requires elevation. 6. Pin the CLI version used by the Skill and document a controlled upgrade process so that future remote changes do not silently alter audited behavior. 7. Keep installation separate from normal Skill execution. The existing instruction to install only after an actual `command not found` error should remain, but it does not replace payload verification.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill includes a shell one-liner that downloads a remote script and pipes it directly to bash. This is dangerous because it executes unverified code from the network without integrity checking, review, or pinning, so a compromised host, tampered script, or MITM in a weakened environment could lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest description says to use this skill for "ANY Amplemarket request" and "Whenever a task involves Amplemarket," which is a very broad activation condition. It does not provide boundaries, exclusions, or negative examples, so ordinary mentions of Amplemarket could trigger the skill unintentionally.

Static analysis

No suspicious patterns detected.