BALLDONTLIE World Cup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:36 AM UTC
• Version: 1.0.2

Overview

The skill is mainly for reading World Cup data, but its setup instructions include running an unverified remote installer directly in a shell.

Use this skill only if you already trust OOMOL and the BALLDONTLIE connector. Prefer installing the oo CLI through a verified, organization-approved method, or manually inspect and verify the installer before running it. Do not let an agent run the first-time setup commands automatically or from an elevated shell.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:74

Finding

Unverified Remote Installer Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74–78
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe remotely retrieved content directly into bash or PowerShell's Invoke-Expression. Neither command pins an immutable installer version nor verifies a cryptographic signature or checksum before execution. Consequently, the code ultimately executed can differ from the content assessed during this audit.

The URLs use HTTPS and appear consistent with the documented OOMOL service, and installation is presented only as a fallback when the CLI is unavailable. However, transport encryption alone does not establish the integrity or immutability of the installer. A compromised hosting service, publishing pipeline, domain, account, or TLS trust path could replace the installer with arbitrary commands.

This installation behavior is not necessary for the Skill's ordinary read-only World Cup data operations. The Skill can require the CLI as a prerequisite without automatically executing mutable remote code. It therefore exceeds the minimum privileges needed during normal Skill execution.

No evidence in the reviewed file proves that the current remote installer contains a malicious payload. The vulnerability is the unverified, mutable remote-code execution mechanism itself.

Attack Path

1. The oo command is absent, causing an action to fail with oo: command not found.
2. An agent or user follows the first-time setup instructions in SKILL.md.
3. The system retrieves install.sh or install.ps1 from the remote OOMOL host.
4. The response body is passed directly to bash or Invoke-Expression without inspection, version pinning, signatur ...[truncated 1062 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash and irm | iex installation commands.
2. Treat the oo CLI as a documented prerequisite and require explicit user approval before installing software.
3. Prefer a trusted operating-system package manager or an official, versioned release repository.
4. Pin the installer or binary to a specific immutable release instead of a mutable generic URL.
5. Download the artifact to a local file without executing it:
   • Use a destination with restrictive permissions.
   • Reject redirects to unapproved domains.
   • Inspect the downloaded artifact before execution.
6. Verify a publisher-provided cryptographic signature or a SHA-256 checksum obtained through a separately authenticated channel.
7. Execute the verified installer as a separate step and with the least-privileged account possible.
8. Do not request administrator or root privileges unless a documented installation operation strictly requires them.
9. Record and display the exact version, source URL, expected digest, and installation effects so users can make an informed decision.
10. For managed environments, direct users to organization-approved software deployment procedures rather than performing installation from Skill instructions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This is dangerous because it executes unverified network content with the user's privileges, enabling supply-chain compromise, MITM/domain compromise impact, or execution of unexpected installer behavior without prior inspection.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Static analysis

No suspicious patterns detected.