Beamer

• Outcome: Review
• Latest audit: Nov 4, 2026 · 5:28 AM UTC
• Version: 1.0.6

Overview

The Beamer workflow has sensible controls, but its software dependency can change other agents’ installed skills without clear notice here.

Before use, review and approve a specific CLI release and its installer. Disable startup skill synchronization with OO_SKILLS_SYNC_DISABLED=1 if you do not want other agent skill directories changed. OOMOL will mediate your connected Beamer access; retain the required confirmation before creating posts. The remote installer and connector implementations were not verified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code executes an installer hosted by Oomol, while the description presents a Beamer data-management skill. Nothing in the supplied chunk establishes that this installer supports Beamer functionality. The downloaded script's further behavior is unknown, but the visible remote-code execution and unrelated installation purpose are not represented by the declaration.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The setup command pipes a mutable remote script directly into Bash without version pinning or independent integrity verification; the PowerShell alternative has the same problem. A compromised distribution endpoint could execute arbitrary code with the invoking user's privileges, exposing local files and credentials. Restricting installation to a missing-CLI error reduces exposure frequency but does not make execution safe, and there is no evidence that the current installer is malicious.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources