BigMailer

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:18 AM UTC
• Version: 1.0.3

Overview

The skill is coherent for managing BigMailer, but its fallback setup tells users or agents to execute remote installer scripts directly, which needs review before installation.

Review the setup path before installing. Use this skill only if you trust OOMOL and the oo CLI distribution channel, and avoid running the remote installer commands without separately checking the official installer source, version, and integrity. For BigMailer changes or deletes, confirm the exact target and payload before allowing the action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:67
• Finding: Unverified Remote Installer Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 67–71 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions retrieve installation scripts from remote URLs and immediately pass their contents to a command interpreter. Neither command pins the installer to an immutable version nor performs checksum, digital-signature, or provenance verification before execution. The effective code executed by these commands is not contained in the audited project and can change after the Skill has been reviewed. HTTPS protects the connection in transit but does not ensure that the hosted script remains unchanged or safe if the distribution infrastructure, domain, or publishing account is compromised. This behavior exceeds the minimum privileges required to document how to operate the BigMailer connector. Installing a system-level CLI is also distinct from invoking the declared `oo` commands. Although the installation steps are presented as an authentication-error fallback rather than part of every action, an agent or user following them would still execute unreviewed remote code. The PowerShell command has the same security properties as the Unix command: `irm` retrieves the script and `iex` immediately evaluates it in the current PowerShell process. ### Attack Path 1. The `oo` CLI is absent, causing an `oo: command not found` error. 2. The agent or user follows the first-time setup instructions. 3. The command retrieves the current installer from `cli.oomol.com`. 4. A compromised hosting service, publishing pipeline, domain, or installer endpoint returns attacker-controlled script content. 5. The pipe to `bash`, or the use of `iex`, executes that content without local ...[truncated 999 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation patterns. 2. Direct users to an official, versioned installation guide rather than instructing an agent to execute an installer automatically. 3. Pin downloads to a specific immutable release and trusted artifact URL. 4. Download the artifact to disk without executing it immediately. 5. Publish and verify a cryptographic checksum or, preferably, a digital signature using a separately distributed trusted public key. 6. Display the exact version, source, permissions, and intended changes before installation, and require explicit user approval. 7. Prefer a signed platform package distributed through a reputable package manager where available. 8. Run installation with ordinary user privileges unless elevated privileges are strictly necessary and separately approved. 9. Keep installation outside the Skill's normal action path. The Skill should invoke only the already-installed `oo` CLI under its declared `Bash(oo *)` tool restriction. 10. Document how users can review, uninstall, and verify the installed CLI. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill recommends installing software via a remote shell pipeline ('curl ... | bash'), which executes network-fetched code immediately without prior verification. If the install endpoint, transport, DNS, or hosting path is compromised, or if the user is socially engineered into running it, this can lead to arbitrary code execution on the host.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The description says to use this skill for "ANY BigMailer request" and "Whenever a task involves BigMailer," which is a very broad trigger without constraints or exclusion examples. For a manifest/markdown file, this can overlap with many ordinary references to BigMailer and does not clearly define when the skill should not activate.

Static analysis

No suspicious patterns detected.