Brex

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:19 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent Brex read connector, but it needs review because setup recommends running unverified remote installer scripts and its trigger is broad for financial data access.

Install only if you trust OOMOL and understand it will use an authenticated Brex connection to read company financial data. Avoid running the curl-to-shell or PowerShell iex installer blindly; prefer a verified package, pinned release, checksum, or reviewed installer. Use least-privileged Brex credentials and confirm any future write or destructive connector action explicitly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 63–67 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable code:** ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download scripts from `cli.oomol.com` and execute the returned content immediately through Bash or PowerShell. The scripts are not pinned to an immutable version, saved for inspection, or verified using a cryptographic signature or expected hash. Consequently, the effective installer payload can change after this Skill has been reviewed. Although the URL appears to be associated with the declared OOMOL service, compromise of its hosting infrastructure, publisher account, DNS resolution, or applicable TLS trust chain could turn these installation commands into arbitrary code-execution mechanisms. Installing the required CLI can be legitimate, but directly executing an unverified network response exceeds the minimum behavior necessary for installation. A pinned and cryptographically verified package would accomplish the same task with substantially lower supply-chain risk. ### Attack Path 1. The `oo` CLI is absent, and an attempted connector command fails with `oo: command not found`. 2. The user or agent follows the first-time setup instructions. 3. The command retrieves the current response from the remote installer endpoint. 4. Bash or PowerShell executes that response without integrity verification or prior inspection. 5. If the endpoint or delivery chain has been compromised, attacker-controlled code executes with the privileges of the user running the command. 6. The payload could then access data and credentials available to that account, modify local files, or establish further compromise. ### Impact Assess ...[truncated 583 chars]
• Remediation: ## Remediation Suggestions - Remove all `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation patterns. - Prefer an official operating-system package manager or a signed platform installer from a pinned release. - Pin the CLI to a specific version rather than retrieving a mutable latest installer. - Download the artifact to a local file before execution. - Publish and verify an expected SHA-256 digest or, preferably, a cryptographic signature tied to a documented publisher key. - Abort installation if integrity or signature validation fails. - Allow users to inspect the downloaded artifact before running it. - Execute installation with ordinary user privileges unless a narrowly defined operation genuinely requires elevation. - Document the package source, version, expected publisher identity, verification procedure, and files or permissions modified by installation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill recommends installing software by piping a remote script directly into a shell, which is a classic supply-chain risk because the fetched content executes immediately without review, pinning, or integrity verification. This is more dangerous here because the skill is tied to authenticated financial-system access, so compromising the CLI environment could expose Brex-connected operations, user session state, or broader workstation access.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger text instructs use of this skill for "ANY Brex request," which is unnecessarily broad and can cause the agent to invoke the skill for loosely related or higher-risk Brex tasks without clear boundaries. In this context, the skill can access company financial data via an authenticated connector, so ambiguous routing increases the chance of unintended data access or overuse beyond the user's precise intent.

Static analysis

No suspicious patterns detected.