Bitrise

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:58 AM UTC
• Version: 1.0.2

Overview

This Bitrise connector skill is mostly purpose-aligned, but its first-time setup tells agents to execute remote installer scripts directly without verification.

Review this skill before installing if the oo CLI is not already present. The Bitrise actions are clearly described and write actions require confirmation, but avoid letting an agent run the documented curl|bash or irm|iex installer automatically; install the CLI through a verified, user-controlled process instead.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Remote Shell Script Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command pipes a network response directly into `bash`. The downloaded script is mutable external content whose effective behavior can change after the Skill has been reviewed. No version pinning, cryptographic signature validation, checksum verification, local inspection, or execution isolation is required. HTTPS protects the connection in transit but does not make the payload immutable and does not protect users if the hosting service, publishing process, DNS path, or signing credentials are compromised. The `-f` and `-s` options also reduce visibility into failures and downloaded content. Installation is conditional on `oo` being unavailable, but the instruction still authorizes execution of arbitrary remote shell code. Installing the CLI may support the declared Bitrise functionality, but immediate execution of an unverified response exceeds the minimum privilege and trust necessary to invoke an already installed connector. ### Attack Path 1. The Agent attempts to use `oo` and receives an `oo: command not found` error. 2. It follows the first-time setup instructions in `SKILL.md`. 3. `curl` retrieves the current response from `https://cli.oomol.com/install.sh`. 4. The pipe sends that response directly to `bash` without integrity verification or review. 5. If the remote response or delivery infrastructure has been compromised, attacker-controlled shell commands execute with the privileges of the user running the Agent. 6. Those commands can access user-readable data, modify user-owned files, install additional software, or establish further network communication. ### Impact Assessment Successful exploitation provides arbi ...[truncated 402 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pipeline. - Prefer a trusted operating-system package manager or a signed, version-pinned release. - Download the installer as a separate file rather than executing the HTTP response directly. - Pin an expected version and SHA-256 digest, then verify the digest before execution. - Verify a publisher signature using a trusted key distributed through an independent channel. - Display the source, destination, version, permissions, and expected system changes to the user. - Require explicit user approval immediately before running any installer. - Execute installation with ordinary user privileges unless a specific, documented operation requires elevation. - Keep CLI installation outside routine Skill execution where practical.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Remote PowerShell Script Downloaded and Executed Through Invoke-Expression## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` retrieves a remote PowerShell response and pipes it directly into `iex` (`Invoke-Expression`). This causes the current contents served by the external URL to be interpreted as PowerShell code without version pinning, signature validation, checksum verification, review, or sandboxing. The actual executed program is therefore not contained in the audited project and can change independently after review. TLS does not address compromise of the server, deployment pipeline, account, or other trusted delivery infrastructure. `Invoke-Expression` is especially dangerous here because it treats downloaded text as executable commands in the current PowerShell context. Although this instruction is presented as conditional first-time setup, executing an unverified remote response is not necessary to perform Bitrise connector operations when a verified CLI can instead be installed through a controlled process. ### Attack Path 1. The Agent attempts to use `oo` on Windows and finds that the command is unavailable. 2. It follows the documented first-time setup command. 3. `Invoke-RestMethod` retrieves the current content from `https://cli.oomol.com/install.ps1`. 4. The pipeline passes the response directly to `Invoke-Expression`. 5. A compromised or malicious response executes in the current PowerShell process with the invoking user's permissions. 6. The payload can run additional processes, modify accessible files and PowerShell profiles, retrieve further payloads, or transmit accessible information over the network. ### Impact Assessment Exploitation permits arbitrary PowerShell execution with all privileges available to the invoking user ...[truncated 357 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern and do not evaluate network responses directly. - Distribute the Windows CLI through a trusted package manager or a signed, versioned installer. - Download the installer to a local file and verify its Authenticode signature and a pinned cryptographic digest before execution. - Refuse installation when signature, publisher, version, or checksum verification fails. - Present the verified installer details and anticipated changes to the user before requesting explicit approval. - Avoid administrative elevation unless a documented installation step strictly requires it. - Run installation as a separate, auditable setup operation rather than as part of normal connector use.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`). This pattern is dangerous because it executes network-fetched code without prior verification, so a compromised server, CDN, DNS path, or TLS trust chain could lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Line L03 says to use this skill for "ANY Bitrise request," covering all reading, creating, and updating tasks involving Bitrise. This is a broad activation condition without exclusions or negative examples, which could cause unintended invocation for loosely related Bitrise mentions.

Static analysis

No suspicious patterns detected.