Atlas.so

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.3

Overview

The Atlas.so skill is mostly coherent, but its setup guidance includes unverified remote installer commands that can execute changing external code on a user's machine.

Review the oo CLI installation path before installing. Prefer a signed or package-manager install, or download and inspect/verify the installer before running it. Once installed, the skill's normal Atlas operations are scoped through the oo connector, but write actions can change Atlas customer or account records and should only be approved after checking the payload.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64

Finding

Unverified Remote Installer Download and Immediate Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The first-time setup instructions provide two platform-specific commands that download mutable content from an external server and execute it immediately:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both commands pass an external HTTP response directly to a command interpreter. The instructions do not pin an installer version, verify a cryptographic checksum or publisher signature, or provide an opportunity to inspect the downloaded file before execution.

Consequently, the code ultimately executed is not fixed by the reviewed Skill and may change after the audit. Compromise of the installer host, publishing account, hosting infrastructure, DNS or TLS trust path could turn these commands into an arbitrary-code-execution mechanism.

Installing the CLI may be necessary for the declared Atlas.so integration, but immediate execution of unverified remote content exceeds the minimum privilege and trust required to perform installation. A package-manager installation or a separately downloaded, version-pinned, cryptographically verified artifact would provide the required functionality with lower risk.

Attack Path

1. The oo CLI is absent, and a command fails with oo: command not found.
2. A user or agent follows the Skill's first-time setup instructions.
3. An attacker compromises the remote installer publication channel or causes the endpoint to return attacker-controlled content.
4. On macOS or Linux, curl streams the response directly into bash; on Windows, Invoke-RestMethod supplies it directly to Invoke-Expression.
5. The attacker's commands execute with the privileges of the user running the installat ...[truncated 1080 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct download-to-interpreter patterns:
   • Do not pipe curl output directly to bash.
   • Do not pass Invoke-RestMethod output directly to Invoke-Expression.
2. Prefer an official operating-system package manager or a signed, versioned release package from a documented publisher.
3. Pin the installer or CLI to a specific reviewed version rather than retrieving a mutable latest installer.
4. Download the artifact to a local file before execution.
5. Publish and verify a cryptographic publisher signature. Where signature verification is unavailable, verify a SHA-256 digest obtained through an independently trusted and version-specific channel.
6. Abort installation if verification fails; never treat checksum or signature failures as warnings.
7. Allow the installer content to be inspected before execution and document the files, network endpoints, and system changes it performs.
8. Run installation with standard-user privileges unless a specific operation demonstrably requires elevation. Avoid blanket sudo or administrator execution.
9. Keep setup manual and conditional. The agent should not automatically install software merely because oo is unavailable.
10. If automated installation is essential, package a reviewed, version-pinned installer through a trusted release mechanism rather than executing mutable network responses.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install software via curl ... | bash, which executes a remote script without prior verification. If the install endpoint, transport, DNS, or hosting environment is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for "ANY Atlas.so request," which is a very broad activation condition without boundaries or exclusion examples. This can cause the skill to match a wide range of ordinary Atlas.so-related requests, even when the user may not intend to invoke this specific skill path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.