Bannerbear

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:32 AM UTC
• Version: 1.0.2

Overview

The Bannerbear skill is service-focused, but its setup instructions include running unverified installer scripts directly from the internet.

Review the installer path before using this skill. Normal Bannerbear actions appear scoped through the oo connector, but do not let an agent run the provided remote installer one-liners automatically; prefer an official package manager, a versioned download, and checksum or signature verification before installation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Shell Script Execution via curl and Bash## Vulnerability Details **File Location**: `SKILL.md`, line 59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable shell script from an external server and pipes it directly into Bash. The script is executed without version pinning, cryptographic signature verification, checksum validation, or an opportunity to inspect the downloaded content. Installation of the declared CLI may be necessary for the Skill, but immediate remote-to-shell execution is not the minimum privilege or safest installation mechanism required to provide that functionality. The effective payload can change after the Skill has been audited. Compromise of the distribution server, domain, release process, or TLS endpoint could therefore turn this documented setup step into arbitrary local code execution. ### Attack Path 1. The `oo` CLI is unavailable, causing the Agent or user to follow the first-time setup instructions. 2. An attacker compromises the remote installation endpoint, its publishing process, or another component capable of controlling the returned script. 3. `curl` retrieves the attacker-controlled response from `https://cli.oomol.com/install.sh`. 4. The pipe sends the response directly to Bash without integrity validation. 5. Bash executes the payload with the privileges of the invoking user. 6. The payload can access data available to that user, modify local files, invoke other programs, or retrieve additional payloads. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The accessible scope may include user-readable files, application credentials, environment variables, authentication material, and writable configuration or executable paths. If the command is run from a privileged a ...[truncated 258 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation pattern. - Prefer an official, trusted package manager with a pinned package version. - If manual installation is required, download a versioned release artifact to disk as a separate step. - Publish and verify a cryptographic signature or checksum over the downloaded artifact before execution. - Fail closed if verification does not succeed. - Allow the user to inspect the downloaded installer before running it. - Execute installation with ordinary user privileges unless a specific installation operation demonstrably requires elevation. - Document the expected files, permissions, and system changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote PowerShell Script Execution via Invoke-RestMethod## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable PowerShell script and passes the response directly to `Invoke-Expression` (`iex`). `Invoke-Expression` evaluates the downloaded text as PowerShell code immediately. No pinned release, Authenticode verification, checksum validation, or manual review boundary is present. Although installing the `oo` CLI supports the declared integration, dynamically executing the latest network response exceeds the minimum mechanism necessary for installation. The command creates a remote code-execution channel whose effective payload can change independently of the reviewed Skill. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. The Agent or user follows the documented PowerShell setup instruction. 3. An attacker gains control over the installation endpoint or its artifact publishing pipeline. 4. `Invoke-RestMethod` obtains attacker-controlled PowerShell source. 5. The pipeline forwards the source to `Invoke-Expression` without authenticity or integrity verification. 6. The payload executes in the current PowerShell process with the invoking user's permissions and can issue further system or network commands. ### Impact Assessment Exploitation results in arbitrary PowerShell execution under the invoking user's security context. This may expose user-accessible files, environment variables, credentials, application configuration, and connected services. The payload could also alter writable profiles or executables and download additional components. Administrator-level execution would substantially increase the impact and could allow system-wide changes. No persistence or elevation b ...[truncated 129 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` execution pattern. - Distribute the CLI through a trusted Windows package manager using a pinned version where possible. - Otherwise, download a versioned installer to a local file before execution. - Require checksum and Authenticode signature verification against values obtained through a trusted release channel. - Reject unsigned, invalidly signed, or checksum-mismatched artifacts. - Present the artifact and intended system modifications for review before execution. - Avoid administrator execution unless a clearly documented operation requires it. - Maintain reproducible, immutable releases so the installed payload corresponds to the version that was reviewed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill includes a shell one-liner that downloads a remote script and pipes it directly into bash. This is dangerous because it executes code from the network without verification, allowing compromise if the hosting domain, transport, installer, or upstream content is tampered with; in a skill context, an agent could also be induced to run it automatically during 'setup' or error recovery.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: This is a manifest/markdown file, so vague-trigger review applies. The phrase "Use this skill for ANY Bannerbear request" is extremely broad and does not define boundaries or exclusions, increasing the chance of unintended invocation whenever Bannerbear is merely mentioned.

Static analysis

No suspicious patterns detected.