Builder.io

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:34 AM UTC
• Version: 1.0.2

Overview

The skill’s Builder.io purpose is coherent, but its fallback setup tells the agent or user to execute unverified remote installer scripts directly, which needs review before installation.

Review the setup path before installing. Use this skill only if you trust OOMOL and are comfortable with Builder.io read/write/delete operations through the oo connector. Avoid running the curl-to-bash or irm-to-iex installer blindly; prefer a verified package, pinned release, checksum or signature validation, and explicit approval before any install or destructive Builder.io action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download scripts from an external server and immediately execute the returned content using Bash or PowerShell. The downloaded payload is not pinned to an immutable release and is not subject to checksum verification, signature validation, or inspection before execution. TLS protects the connection in transit but does not guarantee that the hosted script will remain unchanged or that the distribution server cannot be compromised. Consequently, the effective executable payload may change after this Skill has been reviewed. Installing the required CLI is relevant to the Skill's functionality, but executing an unverified, mutable network response exceeds the minimum privilege necessary to perform installation safely. The scripts execute with all permissions available to the shell's current user. ### Attack Path 1. The `oo` CLI is unavailable, causing the user or agent to consult the first-time setup instructions. 2. The OOMOL distribution server, hosting environment, DNS or delivery infrastructure is compromised, or the hosted script is otherwise replaced. 3. The user executes the documented `curl | bash` or `irm | iex` command. 4. The shell immediately interprets the attacker-controlled response as executable code. 5. The payload performs arbitrary operations under the invoking user's privileges without an intervening verification step. ### Impact Assessment A substituted installer can obtain arbitrary code execution with the privileges of the invoking account. This permits access to files, environment variables, application data, and credentials readable ...[truncated 433 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` execution patterns. 2. Direct users to a pinned, versioned release from the documented upstream repository. 3. Download the installation artifact to a local file before execution. 4. Publish and verify a cryptographic checksum or digital signature using a trusted, independently distributed verification key. 5. Allow the user to inspect the downloaded script before running it. 6. Prefer a trusted platform package manager with signed packages where available. 7. Execute installation with ordinary user privileges and request elevation only for a narrowly defined operation that genuinely requires it. 8. Document the exact destination files, permissions, and other system changes performed by the installer. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Shell Command Injection Risk in Inline JSON Payload Construction<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: Unsafe interpolation of JSON into a shell command **Risk Level**: Medium ### Vulnerable Code ```bash oo connector run "builder_io" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The documented command places generated JSON inside a single-quoted shell argument. JSON strings may legitimately contain apostrophes, and user-controlled Builder.io content may contain shell metacharacters. If an agent constructs this command through textual substitution without shell-safe argument encoding, an apostrophe in the payload can terminate the quoted argument. A malicious value shaped like `'; <command>; #` can cause the shell to treat subsequent text as a new command. JSON serialization alone does not make content safe for interpolation into a shell command because JSON escaping rules differ from shell escaping rules. Exploitation depends on the agent embedding untrusted content directly into the shown command. The same document mentions the safer `@path/to/file.json` option, but it does not require that method for untrusted or dynamically generated payloads. ### Attack Path 1. An attacker supplies a Builder.io field value or user request containing an apostrophe followed by shell control operators and a command. 2. The agent serializes the value as JSON and substitutes the resulting text for the `<json>` placeholder. 3. The agent runs the resulting command through a shell. 4. The apostrophe closes the intended `--data` argument. 5. The shell interprets the remaining attacker-controlled text as one or more local commands. 6. Those commands execute with the privileges of the agent process. ### Impact Assessment Successful exploitation permits arbitrary local command execution as the account running the Skill. An attacker could read or modify accessible files, inspect environment variables, invoke other installed programs, or make outbound n ...[truncated 266 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not interpolate generated or user-controlled JSON directly into a shell command. 2. Serialize the payload with a trusted JSON library and write it to a newly created, permission-restricted temporary file. 3. Pass the file using the supported form: ```bash oo connector run "builder_io" --action "<action_name>" --data @path/to/payload.json --json ``` 4. Create temporary files securely, prevent predictable filenames, restrict permissions to the current user, and remove files after use. 5. Prefer invoking the CLI through a process API that accepts an argument array and does not invoke a shell. 6. Validate action names against the connector's reported schema rather than interpolating arbitrary action text. 7. Add an explicit warning that the inline example is suitable only for fixed, trusted payloads and must not be populated through raw textual substitution. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software by piping a remote script directly into a shell (`curl ... | bash`). This creates a supply-chain and remote code execution risk: if the remote host, network path, or install script is compromised, arbitrary code will execute immediately on the user's system. In this skill context, the danger is elevated because the install step is presented as an operational fallback inside the workflow, making unsafe execution more likely during error handling.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: This markdown skill description defines activation in very broad terms that can overlap with many routine mentions of Builder.io, without clarifying scope boundaries or exclusions. Because it lacks negative examples or narrower constraints, it could cause unintended invocation whenever Builder.io is mentioned incidentally.

Static analysis

No suspicious patterns detected.