Bloomerang

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:08 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for reading Bloomerang data, but its setup instructions include unverified internet scripts that would execute locally.

Review the setup path before installing. Prefer installing the oo CLI through a pinned, verifiable release or trusted package manager, and do not run the documented curl-to-bash or PowerShell irm-to-iex commands unless you independently trust the installer source and understand the local changes it will make. The Bloomerang connector usage itself appears limited to read actions in the reviewed artifact.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Shell Script Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Remote payload retrieval and execution through a shell pipeline **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable script from an external URL and passes it directly to `bash`. The script is executed without being saved for inspection and without version pinning, checksum verification, or cryptographic signature validation. Although the download host is associated with the advertised OOMOL service, the project contains no mechanism that establishes the integrity or immutability of the retrieved content. The effective code executed by this instruction can therefore change after the Skill has been audited. Installing the required CLI may be legitimate, but executing an unverified network response is not the minimum privilege or safest installation mechanism necessary for that purpose. The command creates a remote code-execution channel whose behavior is determined by the server at execution time. ### Attack Path 1. The `oo` CLI is unavailable, causing the agent or user to consult the first-time setup instructions. 2. An attacker compromises the installer hosting infrastructure, publishing process, DNS resolution path, TLS termination point, or another component capable of altering the response. 3. The victim runs the documented `curl` pipeline. 4. `curl` retrieves the attacker-controlled response. 5. The shell executes that response immediately without integrity or authenticity verification. 6. The payload accesses files, credentials, network resources, or processes available to the invoking account and may install additional components. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the account running the command. This may expose user-accessible files, loca ...[truncated 466 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pipe a network response directly into a shell. 2. Direct users to a version-pinned CLI release from an authenticated release channel. 3. Download the installer or binary to a local file without executing it: ```bash curl --proto '=https' --tlsv1.2 -fL -o oo-installer.sh \ 'https://cli.oomol.com/releases/<pinned-version>/install.sh' ``` 4. Publish a SHA-256 digest through a separately protected release mechanism and verify it before execution: ```bash echo '<trusted-sha256> oo-installer.sh' | sha256sum --check - ``` 5. Prefer cryptographic signature verification using a documented vendor signing key. A checksum fetched from the same potentially compromised endpoint is insufficient by itself. 6. Allow the downloaded script to be reviewed before invoking it explicitly: ```bash bash ./oo-installer.sh ``` 7. Prefer a signed package distributed through a reputable operating-system package manager where available. 8. Document the permissions and filesystem changes required by the installer, and instruct users to run it without administrative privileges unless elevation is demonstrably necessary. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote PowerShell Script Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and execution through PowerShell **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction uses `Invoke-RestMethod` (`irm`) to retrieve PowerShell source code from an external URL and pipes the response directly to `Invoke-Expression` (`iex`). `Invoke-Expression` evaluates the downloaded text as code in the current PowerShell session. No fixed release version, Authenticode validation, checksum verification, or opportunity for local inspection is provided. Consequently, the code executed on Windows is controlled by the current content returned from the remote endpoint rather than by the reviewed Skill package. This pattern is particularly unsafe because execution occurs directly in memory and does not require a conventional installer file to be written first. While downloading a CLI can be necessary for the declared functionality, immediate evaluation of an unverified response exceeds the minimum safe mechanism required to install it. ### Attack Path 1. The `oo` CLI is missing on a Windows system. 2. The agent or user follows the documented first-time setup command. 3. An attacker gains control over the hosted installer or another infrastructure component capable of changing the HTTPS response. 4. `Invoke-RestMethod` retrieves the modified PowerShell content. 5. The pipeline supplies that content directly to `Invoke-Expression`. 6. PowerShell executes the attacker-controlled commands in the current session. 7. The payload can access user data and credentials, make further network requests, or establish additional components within the invoking account's permissions. ### Impact Assessment Successful exploitation permits arbitrary PowerShell execution with the privileges and security context of the invoking user. Potentia ...[truncated 469 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `Invoke-RestMethod | Invoke-Expression` installation pattern. 2. Provide a version-pinned, signed installer or PowerShell script from a documented release. 3. Download the artifact to disk without evaluating it: ```powershell Invoke-WebRequest ` -Uri 'https://cli.oomol.com/releases/<pinned-version>/install.ps1' ` -OutFile '.\install-oo.ps1' ``` 4. Verify a published SHA-256 digest: ```powershell $actual = (Get-FileHash '.\install-oo.ps1' -Algorithm SHA256).Hash if ($actual -ne '<trusted-sha256>') { throw 'Installer integrity verification failed.' } ``` 5. Require a valid Authenticode signature from an expected publisher and verify it before execution: ```powershell $signature = Get-AuthenticodeSignature '.\install-oo.ps1' if ($signature.Status -ne 'Valid') { throw 'Installer signature verification failed.' } ``` 6. Execute the verified local file explicitly rather than passing network content to `Invoke-Expression`. 7. Prefer a signed MSI or trusted package-manager distribution where possible. 8. Document required privileges and instruct users to use a non-administrative PowerShell session unless installation genuinely requires elevation. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill includes a pipe-to-shell installation command that fetches a remote script and executes it immediately (`curl ... | bash`). If the remote server, transport path, or hosted script is compromised, users or agents following this guidance could execute arbitrary code on the host system.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill description instructs the agent to use this skill for ANY Bloomerang request, which creates an overly broad routing rule without clear task boundaries or permission constraints. In agentic systems, such catch-all triggers can cause the skill to be invoked in inappropriate contexts, expanding the blast radius of any unsafe behavior or misleading instructions inside the skill.

Static analysis

No suspicious patterns detected.