Security audit

Brex

Security checks for vulnerabilities and agentic risk

Overview

This Brex skill is read-only, but it needs review because it broadly routes Brex requests and sensitive financial data through OOMOL and includes unverified pipe-to-shell installer commands.

Review whether your organization is comfortable routing Brex records through OOMOL before installing. Avoid using the inline installer commands unless you independently trust and verify the installer source, and prefer using the skill only for explicit, account-specific Brex read requests with the narrowest practical filters.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:61
Finding: Unverified Remote Installer Download and Execution
Content: View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions pipe content retrieved from remote URLs directly into `bash` or PowerShell's `Invoke-Expression`. The downloaded content is not pinned to a version and is not authenticated using a published cryptographic signature or verified checksum. It is also not saved for inspection before execution. Although HTTPS protects the connection against ordinary network interception, it does not protect users if the OOMOL domain, server, content-delivery infrastructure, DNS configuration, TLS credentials, or installer publishing pipeline is compromised. The effective code can also be changed after this Skill has been reviewed without any corresponding change to the audited repository. Installing the CLI may be necessary to use the connector, but immediate execution of mutable remote content exceeds the minimum risk necessary to perform installation. ### Attack Path 1. An attacker compromises the installer hosting infrastructure, publishing pipeline, or a privileged account able to change `install.sh` or `install.ps1`. 2. The `oo` command is unavailable on a user's system. 3. The user or Agent follows the documented first-time setup instructions. 4. `curl` or `Invoke-RestMethod` retrieves the attacker-controlled installer. 5. The shell executes the response immediately without integrity verification or review. 6. The payload performs arbitrary operations under the privileges of the user running the command. ### Impact Assessmen ...[truncated 455 chars]
Remediation: View remediation
oo-installer.sh" | sha256sum -c - less oo-installer.sh bash oo-installer.sh ``` - Apply equivalent Authenticode or detached-signature validation to the Windows installation path. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:3
Finding: Sensitive Brex Information Is Routed Through a Third-Party Connector Without Documented Data-Minimization Controls
Content: View full analysis
" ``` ```bash oo connector run "brex" --action "" --data '' --json ``` ```markdown - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. - The response is `{ "data": ..., "meta": { "executionId": "..." } }`; the execution id lives under `meta.executionId`. ``` ### Technical Analysis The Skill requires Brex operations to be performed through OOMOL's server-side connector. Consequently, request parameters and returned Brex records can pass through infrastructure outside Brex and the user's local environment. The available actions include company, user, budget, expense, card-account, and transaction queries, all of which may contain sensitive corporate, employee, and financial information. The intermediary role is disclosed, and the audited file contains no evidence that raw Brex credentials are sent to the Agent. Nevertheless, the instructions provide no controls concerning output minimization, connector scope, retention, telemetry, logging, redaction, or user consent for third-party processing. Broad list operations could disclose more information than a specific task requires. ### Attack Path 1. A user requests Brex account, employee, expense, budget, or transaction information. 2. The Agent follows the Skill a ...[truncated 1075 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: Overbroad Instruction Forces OOMOL Routing for Every Brex-Related Request
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The skill instructs the agent/user to install software by piping a remotely fetched script directly into the shell (curl ... | bash). That creates a supply-chain and remote code execution risk: if the install endpoint, transport, or hosting account is compromised, arbitrary code will run immediately with the user's privileges. In this skill context, the danger is increased because the command is presented as an official recovery path during setup, which may encourage uncritical execution.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description says to use this skill for "ANY Brex request" and "Whenever a task involves Brex," which is extremely broad and overlaps with many ordinary references to Brex. It does not provide scope boundaries, exclusions, or negative examples clarifying when the skill should not activate.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.