Breathe

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:44 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent read-only Breathe connector, but its setup instructions tell users to run unverified remote installer scripts directly in a shell.

Review the installer path before installing. Prefer installing the oo CLI from a pinned, official package or a downloaded script whose checksum or signature you verify first; do not let an agent automatically run the remote install commands. Also remember that using the skill can read HR data available to your connected Breathe account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Shell Script Execution via curl and Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:59` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Complete Code Snippet ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The first-time setup instructions pipe a remotely retrieved installation script directly into Bash. The effective code executed by this command is not included in the reviewed project and can change at any time after the skill has been audited. The instruction does not pin a release, verify a cryptographic signature or checksum, or allow inspection before execution. Consequently, compromise of the hosting service, publication infrastructure, DNS/TLS environment, or installer account could cause arbitrary attacker-controlled shell commands to run. Although installation of the `oo` CLI supports the declared connector functionality, immediate execution of mutable remote content exceeds the minimum safe mechanism necessary to install that dependency. A verified, version-pinned package or artifact would provide the same functionality with less risk. ### Attack Path 1. The `oo` command is unavailable, causing the agent or user to consult the first-time setup instructions. 2. An attacker compromises the installer hosting or release infrastructure, or otherwise causes `https://cli.oomol.com/install.sh` to return modified content. 3. The documented command downloads the modified script. 4. The pipe passes the response directly to Bash without inspection or integrity verification. 5. The malicious script executes with the privileges and environment of the user running the command. 6. The payload may access user-readable files, credentials, environment variables, or install additional components within the user's permission boundary. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The attacker could read or ...[truncated 428 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the `curl | bash` pattern with a version-pinned installation method from an official package repository or release page. - Download the installer to a local file before execution so its contents can be inspected. - Publish a cryptographic checksum or signature through an independently protected channel and verify it before running the installer. - Fail closed if integrity verification fails. - Require explicit user approval before installing software; the agent should not automatically execute installation instructions after a command failure. - Run installation with ordinary user privileges and avoid requesting elevation unless it is strictly necessary and separately approved. - Prefer a pattern such as: ```bash curl -fSLo install.sh "https://cli.oomol.com/releases/<PINNED_VERSION>/install.sh" # Verify an officially published signature or checksum here. bash install.sh ``` The placeholder version and integrity metadata must be replaced with a real, immutable release and trusted verification material. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote PowerShell Script Execution via Invoke-Expression<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:63` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Complete Code Snippet ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup instruction retrieves a mutable PowerShell script using `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). This gives the remote response the semantics of local PowerShell code without version pinning, signature validation, checksum verification, or review. The effective payload is controlled outside the audited project and can change after publication. If the hosting or distribution path is compromised, the command becomes a direct arbitrary-code execution channel. Installing the CLI is relevant to the declared Breathe connector functionality, but immediate evaluation of unverified remote content is not the least-privileged or least-risk installation method. ### Attack Path 1. The `oo` command is unavailable on a Windows system. 2. The user or agent follows the documented PowerShell setup instruction. 3. An attacker who controls or compromises the remote installer distribution path supplies malicious PowerShell content. 4. `Invoke-RestMethod` retrieves that content. 5. `Invoke-Expression` immediately evaluates it in the current PowerShell process. 6. The malicious script operates with the invoking user's permissions and can access the user's environment and available local resources. ### Impact Assessment Successful exploitation permits arbitrary PowerShell execution with the privileges of the invoking user. Potential consequences include theft of user-accessible credentials and files, modification of PowerShell profiles or other user configuration, user-level persistence, security-setting changes allowed to the account, and retrieval or execution of additional payloads. No explicit elevation com ...[truncated 219 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Use a version-pinned, officially signed MSI, MSIX, or PowerShell package where available. - If a script is unavoidable, download it to a file rather than evaluating the network response directly. - Validate an Authenticode signature or a cryptographic hash published through a trusted, independently protected channel before execution. - Require explicit user approval after displaying the artifact source, version, and verification result. - Ensure the installer runs without administrative privileges unless elevation is demonstrably required and separately authorized. - Prefer a workflow such as: ```powershell Invoke-WebRequest ` -Uri "https://cli.oomol.com/releases/<PINNED_VERSION>/install.ps1" ` -OutFile ".\install.ps1" # Validate an official Authenticode signature or published checksum here. & ".\install.ps1" ``` The artifact must be immutable or version-pinned, and execution must be blocked if verification fails. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software by piping a remote script directly into a shell, which is a well-known supply-chain risk. If the remote host, transport path, or script content is compromised, arbitrary code would execute immediately on the user's machine; the setup section makes this more dangerous because it presents the command as the default remediation path for missing tooling.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Breathe request," which is an expansive activation condition without boundaries or exclusions. In a manifest/markdown context, this can overlap with many ordinary requests involving Breathe and does not provide negative examples or scope constraints.

Static analysis

No suspicious patterns detected.