Brave Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:05 AM UTC
• Version: 1.0.3

Overview

The skill’s Brave Search behavior is coherent, but its fallback setup tells an agent to run an unverified remote installer script, which needs review before installation.

Review this skill before installing. The Brave Search connector instructions are narrow and read-oriented, but do not let an agent run the listed curl | bash or irm | iex installer automatically. Install the oo CLI manually from trusted OOMOL documentation or a verified package, then connect Brave Search intentionally.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58

Finding

Unverified Remote Installer Download and Immediate Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions pipe network responses directly into Bash or PowerShell. The remote scripts are not pinned to immutable versions and are not subjected to checksum validation, cryptographic signature verification, or local inspection before execution. Consequently, the code executed by these commands can differ from the content available when the Skill was audited.

Installing the required CLI is related to the Skill's functionality, and the instructions only recommend installation after a command-not-found failure. However, immediate remote-to-shell execution exceeds the minimum privileges and trust necessary to install a dependency safely. A download, verification, and separately approved execution process would achieve the same legitimate purpose with substantially lower supply-chain risk.

The use of HTTPS reduces ordinary interception risk but does not protect against compromise of the vendor domain, DNS infrastructure, hosting environment, release pipeline, or installer-generation process.

Attack Path

1. The oo CLI is absent, causing an oo: command not found error.
2. The user or agent follows the first-time setup instructions.
3. The command retrieves a mutable installer from cli.oomol.com.
4. An attacker who has compromised the domain, hosting infrastructure, DNS path, or release pipeline returns a modified script.
5. Bash or PowerShell executes the response immediately, without integrity verification or an opportunity for inspection.
6. The malicious installer performs arbitrary actions under the privileges of the user running the command.

...[truncated 716 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the pipe-to-shell commands with links to versioned releases or trusted operating-system package repositories.
2. Pin the CLI to a specific, reviewed version rather than retrieving a mutable latest installer.
3. Download the installer or package to a local file without executing it:

   bash

   curl --proto '=https' --tlsv1.2 -fL -o install.sh 'https://example.invalid/versioned/install.sh'
   

4. Publish and verify a cryptographic signature using a pinned, independently distributed public key. If signatures are unavailable, verify a version-specific SHA-256 checksum obtained through a trusted channel.
5. Allow the user to inspect the downloaded file and require explicit approval before executing it as a separate command.
6. Avoid requesting administrator privileges unless a documented installation step strictly requires them.
7. Apply the same controls to the PowerShell installer: download it to disk, validate its Authenticode signature or published hash, inspect it, and execute it separately.
8. Document the files, permissions, and network destinations used by the installer so users can assess the installation's scope.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification, gives the remote server full code-execution capability, and is especially risky in a skill file because an agent may execute it automatically when oo is missing.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Static analysis

No suspicious patterns detected.