Apple Maps

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:55 AM UTC
• Version: 1.0.0

Overview

The skill mostly fits its Apple Maps connector purpose, but its fallback setup tells users or agents to execute a mutable remote installer directly in a shell.

Review this skill before installing. Its normal Apple Maps connector use is narrow, but do not run the one-line remote installer commands unless you independently trust OOMOL's installer source and are comfortable with code from that URL running on your machine. Prefer installing the oo CLI through a pinned, inspectable, or signed distribution path if available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote Installation Scripts Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 63–67 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download installation scripts from `cli.oomol.com` and pass the responses directly to command interpreters. The Unix command pipes the response into Bash, while the Windows command evaluates it through PowerShell's `Invoke-Expression`. The downloaded payload is not pinned to a reviewed version and is not authenticated through a cryptographic signature or checksum distributed over a separate trusted channel. HTTPS protects the connection in transit but does not ensure that the server, publishing account, or current script contents remain trustworthy. The effective code can therefore change after the Skill has been audited. Because the response is executed without first being saved or inspected, any modification or compromise of the remote installer immediately becomes arbitrary local code execution. Although these commands are presented only as fallback installation instructions, direct execution of mutable remote code exceeds the minimum privileges necessary to document or invoke Apple Maps connector operations. ### Attack Path 1. The `oo` command is unavailable, causing the user or Agent to follow the first-time setup instructions. 2. The installer endpoint, its publishing infrastructure, or its associated account is compromised, or the remotely hosted installer is otherwise changed maliciously. 3. The `curl` or `Invoke-RestMethod` command retrieves the modified response. 4. Bash or PowerShell executes the response immediately without version pinning, signature verification, checksum validation, or local review. 5. The payload runs with all privileges a ...[truncated 917 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the pipe-to-shell and `Invoke-Expression` installation patterns. 2. Direct users to a version-pinned, reviewed release artifact rather than a mutable installation endpoint. 3. Require the installer to be downloaded to disk before execution so its contents can be inspected. 4. Publish a cryptographic signature or checksum through a separately protected trusted channel and verify it before execution. 5. Prefer signed packages delivered through trusted platform package managers where available. 6. Display the exact version, source, expected digest, and actions performed by the installer. 7. Require explicit user approval before running any installer, especially when elevated privileges would be involved. 8. Avoid automatically invoking installation commands from the Skill. If installation is required, return instructions and let the user perform the verified installation separately. A safer conceptual workflow is: ```bash curl -fSLo oo-installer.sh "https://trusted.example/releases/<pinned-version>/install.sh" echo "<trusted-sha256> oo-installer.sh" | sha256sum --check - less oo-installer.sh bash oo-installer.sh ``` The artifact URL, version, and digest must be fixed to a reviewed release, and the digest must not be obtained solely from the same potentially compromised endpoint. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remote script directly into the shell, which enables arbitrary code execution from content fetched at runtime without prior verification. Because the skill content is potentially adversarial and the command runs in a shell context, compromise of the hosting domain, transport, or script contents could lead to full execution of attacker-controlled code on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Apple Maps request" and "Whenever a task involves Apple Maps," which is an expansive trigger likely to overlap with many ordinary mapping tasks. It does not provide narrower activation boundaries or negative examples, so invocation conditions are broader than necessary.

Static analysis

No suspicious patterns detected.