Security audit

Beaconcha.in

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Beaconcha.in connector, but its fallback setup tells agents to execute an unverified remote installer.

Review before installing. The Beaconcha.in query behavior is coherent, but avoid running the pipe-to-shell installer blindly; install the oo CLI from a trusted, reviewable, version-pinned source when possible, and be aware that connector requests are routed through OOMOL infrastructure.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:56
Finding: Unverified Remote Installer Download and Execution
Content: View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download executable content from an external URL and immediately pass it to a command interpreter. The Unix command pipes the HTTP response directly into Bash, while the Windows command evaluates the response using `Invoke-Expression`. Neither instruction pins an immutable release, verifies a cryptographic signature or checksum, nor allows the downloaded content to be reviewed before execution. Consequently, the effective installer can change after the Skill package has been audited. HTTPS provides transport protection but does not mitigate compromise of the publisher, hosting infrastructure, DNS, CDN, or installer deployment process. Installation is only presented as a fallback when `oo` is unavailable, but installing a remote executable is not inherently necessary to the Skill's read-only Beaconcha.in operations and exceeds the privileges required merely to retrieve public blockchain data. ### Attack Path 1. The Agent attempts to run an `oo` connector command. 2. The command fails because the CLI is not installed. 3. Following the Skill instructions, the Agent executes the relevant installation command. 4. The command retrieves the current response from `cli.oomol.com`. 5. Bash or PowerShell executes that response immediately with the invoking user's privileges. 6. If the upstream installer or delivery infrastructure has been compromised, arbitrary attacker-controlled commands execute on the local system. ...[truncated 696 chars]
Remediation: View remediation

other

Warning

Location: SKILL.md:24
Finding: Beaconcha.in Query Data Is Routed Through an Additional Third Party
Content: View full analysis
" ``` ```bash oo connector run "beaconchain" --action "" --data '' --json ``` ```markdown - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. - The response is `{ "data": ..., "meta": { "executionId": "..." } }`; the execution id lives under `meta.executionId`. ``` The Skill metadata additionally states: ```yaml description: "Beaconcha.in (beaconcha.in). Use this skill for ANY Beaconcha.in request — searching and reading data. Whenever a task involves Beaconcha.in, use this skill instead of calling the API directly." ``` ### Technical Analysis The Skill requires Beaconcha.in requests to be sent through OOMOL's `oo` connector rather than directly to Beaconcha.in. The JSON supplied through `--data` is therefore transmitted to additional remote infrastructure for processing or relay. This intermediary is part of the Skill's declared operating model and enables server-side credential injection. However, forcing intermediary routing for every Beaconcha.in request can exceed the minimum data exposure required for requests involving public blockchain information, particularly where direct API access would suffice. The transmitted payload may include validator identifiers, chain selections, request parameters, and associated usage metadata. The reviewed file does not define the intermediary's retention policy, logging behavior, access controls, or precise handling of submitted data. No evidence was found that the Skill collects local credentials, private keys, environment variables, or unrelated local files. ### Attack Path 1. A user requests Beaconcha.in network or validator information. 2. The Agent retrieves the connector sch ...[truncated 971 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell, which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, or upstream release process is compromised, arbitrary code would execute immediately on the host with the user's privileges.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says to use this skill for "ANY Beaconcha.in request" and "Whenever a task involves Beaconcha.in," which is a very broad activation condition. It does not provide boundaries, exclusions, or negative examples to clarify when the skill should not be invoked.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.