BigPicture.io

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.3

Overview

This is a mostly coherent BigPicture.io lookup skill, but its setup instructions can execute an unverified remote installer on the user's machine.

Review the setup path before installing. The BigPicture.io lookup behavior appears read-only, but do not let an agent run the remote installer automatically; install the oo CLI through a verified or reviewed method and confirm any authentication or connection steps yourself.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56

Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56-60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The first-time setup instructions provide direct download-to-execution commands for both Unix-like systems and Windows:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

These commands retrieve mutable content from an external server and immediately execute it using bash or PowerShell's Invoke-Expression. The instructions do not pin a reviewed release, verify a cryptographic signature or hard-coded digest, save the payload for inspection, or obtain explicit approval immediately before execution.

HTTPS protects the network connection in transit but does not guarantee that the delivered script is safe. Compromise of the vendor host, publishing pipeline, DNS infrastructure, certificate issuance process, or account controlling the hosted scripts could cause the same reviewed Skill instructions to execute a different payload later.

Installing the oo CLI may support the declared BigPicture.io connector workflow, but executing an unverified remote script is not the minimum privilege or minimum-risk mechanism necessary to install it. The downloaded script receives all permissions held by the user or agent process.

Attack Path

1. The oo command is unavailable, causing the agent or user to follow the first-time setup instructions.
2. An attacker compromises the external script host, its deployment pipeline, or another component capable of controlling the response.
3. The attacker replaces install.sh or install.ps1 with malicious content.
4. curl | bash or irm | iex transfers the response directly into a command interpreter without local verification.
5. The malicious commands execute with the permissions of th ...[truncated 1035 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash and irm | iex installation commands.
• Prefer a trusted operating-system package manager or an official package repository with a pinned CLI version.
• If direct download is necessary, download the installer to a local file without executing it.
• Pin the download to an immutable, reviewed release rather than a mutable generic installation URL.
• Publish and verify a cryptographic signature using a separately distributed, trusted public key.
• Verify a hard-coded SHA-256 or stronger digest before execution; do not retrieve the expected digest from the same mutable location as the installer.
• Allow the user to inspect the downloaded script and clearly disclose the files, permissions, and configuration it will modify.
• Require explicit user approval before executing installation code.
• Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation, and isolate the process where practical.
• Fail closed if signature, digest, version, or origin validation does not succeed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends installing software via a remote script piped directly to the shell (curl ... | bash). If the install endpoint, transport, or upstream distribution path is compromised, this leads to immediate arbitrary code execution on the user's machine, which is especially dangerous in a skill that may be followed automatically during troubleshooting.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest and description position the skill as being for 'searching and reading data,' but the body instructs the agent to inspect and invoke arbitrary connector actions and even discusses handling [write] and [destructive] operations. This mismatch can cause an orchestrator or user to trust the skill as read-only when it may actually perform state-changing operations, increasing the risk of unintended writes or destructive actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The safety section describes a model for handling [write] and [destructive] actions, but the visible action list contains only read actions and no tagged state-changing operations. This inconsistency weakens operator understanding of the true capability boundary and may mask future expansion to unsafe actions without corresponding manifest or review updates.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.