BotStar

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:11 AM UTC
• Version: 1.0.2

Overview

The BotStar integration is mostly coherent, but its setup instructions tell the agent to run remote installer scripts directly in a shell without verification.

Install only if you are comfortable with OOMOL's BotStar connector model and do not let an agent run the first-time installer automatically. Prefer installing the oo CLI through a documented, verifiable method, review any installer before execution, and require explicit approval before write, publish, update, or delete BotStar actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:75
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 75–79 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download remote installation scripts and execute their responses immediately using Bash or PowerShell. The instructions do not pin an immutable release, verify a cryptographic signature or checksum, or provide an inspection step before execution. Although HTTPS provides transport protection, it does not ensure that the retrieved script remains identical to the version assessed during this audit. Compromise of the hosting server, distribution pipeline, domain, certificate-authorized infrastructure, or publisher account could cause arbitrary replacement content to execute. The effective payload can therefore change after the Skill package has been reviewed. Installing the required CLI may be legitimate, but direct pipe-to-shell execution is not the minimum privilege or minimum-risk method necessary to support the declared BotStar connector functionality. ### Attack Path 1. The `oo` CLI is unavailable, and an agent or user follows the documented first-time setup. 2. An attacker compromises or gains control over the remote installation-script delivery path. 3. The request to `https://cli.oomol.com/install.sh` or `install.ps1` returns attacker-controlled code. 4. `bash` or `iex` executes the response immediately without integrity verification or prior inspection. 5. The payload runs with the permissions of the invoking user and can perform any action available to that account. ### Impact Assessment Successful exploitation permits arbitrary command execution with the invoking user's privileges. Depending on those ...[truncated 536 chars]
• Remediation: ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` installation commands. 2. Pin the CLI to a specific, immutable release and download it from an authenticated official release location. 3. Publish trusted SHA-256 checksums and, preferably, cryptographic signatures for each platform artifact. 4. Separate download, verification, inspection, and installation into distinct steps. 5. Abort installation if checksum or signature verification fails. 6. Prefer a trusted operating-system package manager or signed platform-native installer where available. 7. Document that installation should use a non-administrative account unless elevated privileges are explicitly required for a narrowly defined step. 8. Keep the existing behavior of attempting connector actions first and invoking setup only after a genuine missing-command error.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). If the remote host, transport, CDN, or installation script is compromised, this results in immediate arbitrary code execution on the user's machine. In skill context this is more dangerous because the instruction appears as an operational fallback, making automated or semi-automated execution more likely during error handling.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY BotStar request," covering reading, creating, updating, and deleting data without narrowing scope or giving exclusion conditions. That phrasing is broad enough to match many ordinary references to BotStar and does not specify boundaries or negative examples for when the skill should not activate.

Static analysis

No suspicious patterns detected.