Businessmap

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:32 AM UTC
• Version: 1.0.2

Overview

This Businessmap skill is purpose-aligned, but its setup instructions can run unverified remote installer code on the user's machine.

Review the setup path before installing. Use this skill only if you are comfortable with OOMOL mediating Businessmap access, and avoid running the documented installer commands unless you have verified the installer source and integrity through a safer channel. For write or delete actions, confirm the exact Businessmap object and payload first.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable shell script from an external URL and pipes it directly into Bash. The downloaded content is not pinned to a reviewed release and is not verified through a cryptographic signature or published checksum before execution. Although installing the `oo` CLI supports the Skill's declared Businessmap functionality, immediate network-to-shell execution is not the minimum safe mechanism required to install that dependency. The behavior transfers control of the local shell to whatever content the remote server returns at execution time. Consequently, the effective code can change after the Skill has been reviewed. HTTPS protects the connection in transit but does not mitigate compromise of the hosting service, publishing account, DNS/TLS trust chain, or installer build pipeline. The `-f`, `-s`, and `-S` options also do not authenticate the script's contents. ### Attack Path 1. An attacker compromises the installer host, its deployment pipeline, its publishing credentials, or another component capable of controlling the response from `https://cli.oomol.com/install.sh`. 2. The attacker replaces or modifies the installer response to include malicious shell commands. 3. A user or agent encounters an `oo: command not found` error and follows the documented setup instruction. 4. `curl` retrieves the attacker-controlled response and streams it directly to Bash. 5. Bash executes the payload without an intermediate review, integrity check, or version-pinning step. 6. The payload can perform actions available to the invoking user and may attempt additional privilege escalation if the environment permits i ...[truncated 716 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | bash` pipeline from the Skill instructions. 2. Prefer an established operating-system package manager or a pinned release artifact from a verified official repository. 3. Pin the installer or binary to a specific version rather than retrieving a mutable latest installer. 4. Publish and verify a cryptographic signature or trusted checksum before execution. 5. Download the artifact to a local file first, validate its expected origin and integrity, and allow it to be reviewed before running it. 6. Require explicit user approval before installing software; the agent should not automatically execute installation commands after a command-not-found error. 7. Run installation with ordinary user privileges wherever possible and clearly document any permissions the installer requires.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 68 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable PowerShell script and passes the resulting content directly to `Invoke-Expression` (`iex`). `Invoke-Expression` interprets the remote response as PowerShell code without pinning, inspection, signature verification, or checksum validation. The command therefore permits the externally hosted response to determine which code runs on the local Windows system. The payload can change independently of the reviewed `SKILL.md` file. HTTPS does not establish that the returned script matches a specific audited release and cannot protect against compromise of the legitimate publisher or delivery infrastructure. Installing the CLI is related to the declared service, but executing unverified remote text through `iex` exceeds the minimum privilege and trust necessary to provide installation guidance. ### Attack Path 1. An attacker gains control over the Windows installer response through compromise of the hosting service, release pipeline, publishing credentials, or relevant network trust infrastructure. 2. The attacker serves malicious PowerShell content from `https://cli.oomol.com/install.ps1`. 3. A user or agent follows the first-time setup instruction after the CLI is reported missing. 4. `Invoke-RestMethod` retrieves the malicious content. 5. The pipeline sends that content directly to `Invoke-Expression`. 6. PowerShell executes the payload under the invoking user's security context, without verifying that it corresponds to a reviewed installer. ### Impact Assessment Successful exploitation enables arbitrary PowerShell execution with the invoking user's pr ...[truncated 593 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `irm | iex` command from the documentation. 2. Distribute the CLI as a version-pinned, signed Windows package or through a reputable package manager. 3. Require validation of the package's Authenticode signature and publisher identity before installation. 4. If a standalone artifact is used, publish a cryptographic checksum through a separately protected channel and verify it before execution. 5. Download the installer to disk rather than evaluating the network response directly. 6. Require explicit user confirmation before executing any installer and clearly state the requested privilege level. 7. Avoid administrator elevation unless a documented installation operation strictly requires it.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 96% confidence
• Finding: The skill instructs users to install the CLI via a curl-piped-to-shell command that downloads and executes remote code without verification. If the install endpoint, transport, or upstream distribution is compromised, this leads to arbitrary code execution on the host running the command.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text says to use this skill for ANY Businessmap request and instead of calling the API directly, which is overly broad and can cause the agent to invoke the skill in situations where more specific handling or additional user confirmation would be safer. In a skill that supports read, write, and destructive actions, broad routing increases the chance of unintended state-changing operations being funneled through this tool.

Static analysis

No suspicious patterns detected.