BigDataCloud

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.3

Overview

This BigDataCloud skill is mostly purpose-aligned, but its first-time setup includes direct execution of a remote installer script, so users should review it before installing.

Before installing, use the official OOMOL CLI installation documentation or a trusted package manager where possible, avoid piping remote scripts directly into a shell, and verify any installer source or checksum. Only connect the intended BigDataCloud account/API key and treat OOMOL login and billing setup as persistent account configuration.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:54

Finding

Unverified Remote Installer Downloaded and Executed by Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54-64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The documented installation commands retrieve mutable scripts from an external server and immediately execute them using Bash or PowerShell. Neither command pins the installer to a reviewed version nor verifies a cryptographic signature or checksum before execution. The effective code executed on a user's system can therefore change after this Skill has been audited.

Although these commands are presented as conditional first-time setup instructions and use a domain represented as official OOMOL infrastructure, transport-layer encryption alone does not establish the integrity of the script publisher or protect against compromise of the distribution server, publishing process, domain, or trusted TLS infrastructure. The PowerShell Invoke-Expression pattern introduces the same fundamental risk as piping curl output directly to Bash.

Installing the CLI may be relevant to the declared connector functionality, but immediate execution of unverified network content exceeds the minimum privilege necessary to provide installation guidance. A safer installation flow can download a version-pinned artifact, authenticate it, and require explicit approval before local execution.

Attack Path

1. The oo command is unavailable, causing the user or Agent to consult the first-time setup instructions.
2. An attacker compromises the installer host, its publishing pipeline, the served installer, or another relevant trust-chain component.
3. The attacker replaces or modifies install.sh or install.ps1 with arbitrary commands.
4. The documented command downloads the ...[truncated 1062 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | bash and Invoke-RestMethod | Invoke-Expression installation patterns.

• Prefer a trusted platform package manager or an official, version-pinned release artifact.

• Download the installer or binary to a local file without executing it automatically.

• Publish a cryptographic signature or checksum through an independently protected channel and verify it before execution.

• Pin the expected version and artifact URL so that reviewed instructions do not silently execute a different future payload.

• Display the resolved source, version, checksum, and intended changes to the user.

• Require explicit user approval before installation; the Agent should not install software automatically after a command failure.

• Run installation with ordinary user privileges unless a specific, documented operation requires elevation.

• If a script-based installer must be retained, provide instructions similar to:

  bash

  curl -fL -o oo-install.sh "https://trusted.example/releases/VERSION/install.sh"
  echo "EXPECTED_SHA256  oo-install.sh" | sha256sum --check
  less oo-install.sh
  bash oo-install.sh
  

  The release URL and checksum must correspond to an immutable, authenticated release and must not use placeholders in production instructions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to execute a remote install script via curl ... | bash, which allows arbitrary code from an external server to run immediately without verification. If the hosting endpoint, CDN, DNS, TLS trust chain, or install script is compromised, this becomes a straightforward remote code execution path on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use this skill for "ANY BigDataCloud request," which is an expansive activation condition without boundaries or exclusions. In a markdown skill description, this can cause unintended invocation for loosely related mentions of BigDataCloud because it does not define scope, constraints, or negative examples.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.