Autotask

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:18 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a read-only Autotask connector, but its first-time setup tells users to execute remote installer scripts directly without verification.

Before installing, verify the oo CLI installer through an official, trusted channel and prefer a signed or checksum-verified installation path. Use the skill for Autotask read/search tasks, and be cautious about letting an agent run first-time setup commands automatically.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely hosted script directly into Bash. The downloaded payload is not pinned to a version and is not authenticated through a published checksum or digital signature before execution. Consequently, the effective code can change after the Skill has been reviewed. Although the URL uses HTTPS and its domain is consistent with the named vendor, transport encryption alone does not establish the integrity of future script versions. Compromise of the vendor endpoint, hosting infrastructure, DNS resolution, TLS trust chain, or publishing account could cause arbitrary attacker-controlled commands to be executed. This behavior is conditional on the `oo` command being unavailable and is not needed during ordinary connector operations when the CLI is already installed. It therefore exceeds the minimum privileges required for the Skill's normal read-only Autotask functionality. ### Attack Path 1. An attacker compromises or redirects `https://cli.oomol.com/install.sh`, or malicious content is published at that mutable endpoint. 2. The `oo` CLI is absent, causing a user or agent to follow the documented first-time setup procedure. 3. `curl` retrieves the attacker-controlled response. 4. The shell pipe sends the response directly to Bash without local inspection or integrity verification. 5. Bash executes the payload with all privileges and environment access available to the invoking user. 6. The payload may access local files and credentials, modify user configuration, download further components, or transmit data externally. ### Impact Assessment Successful exploitation provides arbitrary command execution under the in ...[truncated 638 chars]
• Remediation: ## Remediation Suggestions - Replace direct `curl | bash` execution with a version-pinned installation artifact from a verified official release. - Download the artifact to a local file without executing it automatically. - Publish and verify a cryptographic checksum from an independently authenticated source. - Prefer a signed package and verify its digital signature and expected signer identity. - Allow the user to inspect the downloaded script before execution. - Require explicit user approval before running any installer. - Prefer a trusted operating-system package manager where packages, versions, and signatures can be validated. - Run installation with ordinary user privileges and avoid `sudo` unless a specific, documented operation requires it. - Document the exact files, network destinations, and configuration changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The command uses `Invoke-RestMethod` (`irm`) to retrieve a mutable PowerShell script and pipes the response into `Invoke-Expression` (`iex`). `Invoke-Expression` executes the downloaded text immediately without saving it for review, pinning a release, or validating a checksum or signature. HTTPS protects data in transit but does not prevent a compromised vendor endpoint, publishing account, DNS path, hosting environment, or trusted certificate path from supplying a malicious script. The reviewed Skill provides no independent mechanism for authenticating the downloaded payload. This behavior is only part of conditional first-time setup and is unnecessary for the Skill's normal read-only Autotask actions once the CLI is present. Remote arbitrary code execution is broader than the minimum access required to query Autotask through the `oo` CLI. ### Attack Path 1. An attacker gains control over, or redirects access to, `https://cli.oomol.com/install.ps1`. 2. A Windows user or agent encounters the documented `oo: command not found` condition. 3. `Invoke-RestMethod` downloads attacker-controlled PowerShell source. 4. The pipeline passes the source directly to `Invoke-Expression`. 5. PowerShell executes the payload in the current user's process and security context without integrity verification. 6. The payload may read accessible credentials, alter user configuration, install additional components, establish persistence, or exfiltrate data. ### Impact Assessment Successful exploitation enables arbitrary PowerShell execution with the privileges of the invoking user. An attacker could access user-readable files, environment variables, browser ...[truncated 433 chars]
• Remediation: ## Remediation Suggestions - Do not pipe network responses into `Invoke-Expression`. - Distribute a version-pinned package or installer through a trusted, authenticated release channel. - Download the installer to disk and verify an Authenticode signature from the expected publisher before execution. - Publish a cryptographic checksum through an independently authenticated channel and compare it before running the file. - Require explicit user approval after showing the source, version, signer, and expected installation changes. - Prefer a trusted Windows package manager with package pinning and signature validation. - Execute under a standard user account unless a narrowly defined installation step genuinely requires elevation. - Document expected files, registry changes, network access, and persistence-related changes so users can validate installer behavior.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which executes a remote script directly without prior verification. If the hosting endpoint, transport, or upstream distribution is compromised, this can lead to arbitrary code execution on the user's machine with the user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Autotask request," which is a very broad trigger that could overlap with many ordinary requests mentioning Autotask. It does not provide narrower activation conditions, exclusions, or examples of when not to invoke the skill.

Static analysis

No suspicious patterns detected.