Security audit

Baserow

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using Baserow through OOMOL, but its broad routing mandate and unsafe remote installer instructions need review before installation.

Install only if you are comfortable using OOMOL as an intermediary for Baserow data and have reviewed safer installation options for the oo CLI. Use least-privilege Baserow credentials, avoid sending secrets in row data or filters, and require explicit confirmation before writes or deletes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:58
Finding: Unverified Remote Installer Execution
Content: View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download mutable content from an external server and pass it directly to Bash or PowerShell. The retrieved scripts are not pinned to a specific release, saved for inspection, or validated using a cryptographic signature or checksum. HTTPS provides transport protection but does not establish that the script remains safe over time. Compromise of the hosting server, publishing account, delivery infrastructure, or installer itself would allow the content executed by the same reviewed Skill to change without any modification to this repository. Installing the required CLI is related to the declared Baserow connector functionality. However, executing an unverified network response directly in a shell exceeds the minimum safe privilege and trust requirements for installation. ### Attack Path 1. The agent attempts to use the Skill on a system where the `oo` command is unavailable. 2. The command fails, causing the agent or user to consult the first-time setup instructions. 3. The documented command retrieves `install.sh` or `install.ps1` from the external OOMOL endpoint. 4. An attacker who has compromised the endpoint or its software-delivery path substitutes malicious installer content. 5. Bash or PowerShell executes the response immediately, without integrity verification or an opportunity for inspection. 6. The payload operates with the privileges of the user who launched the command. ### Impact ...[truncated 820 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:2
Finding: Unconditional Routing of Baserow Requests Through a Third-Party Connector
Content: View full analysis
" ``` ```bash oo connector run "baserow" --action "" --data '' --json ``` ### Technical Analysis The Skill instructs the agent to use the OOMOL connector for every Baserow request and explicitly discourages direct API access. This directive controls tool selection for all operations involving Baserow rather than limiting use to cases where the user has knowingly selected OOMOL as an intermediary. The `--data` argument can contain Baserow row values, filters, identifiers, and other user-supplied information. Connector execution necessarily transmits that payload through OOMOL infrastructure, creating an additional trust boundary between the user and Baserow. The transfer is not covert: the document identifies OOMOL, describes server-side credential injection, and provides the connector command. No hard-coded token theft, hidden recipient, or unrelated exfiltration endpoint was found. Routing data through the connector is also relevant to the Skill's declared functionality. The risk arises from the unconditional “ANY Baserow request” instruction and the possibility that users may not understand that record content is being sent through an intermediary. ...[truncated 1440 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to install software via a remote script piped directly into a shell, which executes unreviewed code fetched at runtime. If the install endpoint, transport, or upstream distribution is compromised, this can lead to arbitrary code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The invocation guidance says to use this skill for "ANY Baserow request" and "Whenever a task involves Baserow," which is very broad and could match many ordinary references to Baserow without clear boundaries. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.