Calendarific

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.3

Overview

The skill is coherent for reading Calendarific data, but its setup instructions include direct execution of remote installer scripts if the CLI is missing.

Use this skill only if you trust OOMOL and are comfortable with the oo CLI. If oo is not installed, do not run the pipe-to-shell installer blindly; download from an official source, verify integrity where possible, review the installer, and approve installation explicitly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57

Finding

Unverified Remote Installer Scripts Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The first-time setup instructions execute mutable remote content directly in Bash or PowerShell:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands retrieve executable content from cli.oomol.com and pass it immediately to a command interpreter. They do not pin an installer version, validate a cryptographic checksum, verify a digital signature, or provide an opportunity to inspect the downloaded script.

Although the hostname is consistent with the declared OOMOL provider, the effective code is not included in the audited project and may change after review. Compromise of the hosting service, release process, domain, DNS resolution, or TLS trust chain could therefore turn these commands into arbitrary code-execution channels.

Installing a required CLI may be a legitimate setup operation, but arbitrary shell execution exceeds the minimum privileges needed for the Skill's declared read-only Calendarific functionality. The Skill only needs to query schemas and retrieve holiday, country, and language information. It should not automatically introduce unrestricted execution of unaudited remote code.

The Bash pipeline also lacks an independent integrity check for the installer artifact. Likewise, PowerShell's Invoke-Expression executes the retrieved response as code without validating its origin beyond ordinary HTTPS transport.

Attack Path

1. The user or agent attempts to use the Skill on a system where the oo CLI is unavailable.
2. The first-time setup instructions direct the user to run one of the remote installation commands.
3. An attacker compromises or gains influence over the instal ...[truncated 1349 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove direct curl | bash and Invoke-Expression installation instructions.
2. Distribute the CLI through a reputable platform package manager or a signed, versioned release artifact.
3. Pin an exact CLI and installer version rather than retrieving a mutable installation endpoint.
4. Download the installer to a local file without executing it immediately.
5. Publish and verify a SHA-256 or stronger cryptographic digest over the downloaded artifact.
6. Verify a vendor-controlled digital signature whose trusted public key is distributed independently of the download host.
7. Display the artifact path and verification result before execution, allowing review and explicit user approval.
8. Require informed user confirmation before performing any installation; the agent should never install the CLI automatically following a failed command.
9. Prefer a least-privilege installation that does not require administrator or root access.
10. Document the files, permissions, subprocesses, and network destinations used by the installer.
11. Where practical, include the installer source in an auditable, version-pinned package rather than executing code whose contents can change after Skill review.

A safer conceptual workflow is:

bash

curl -fL -o oo-installer.sh "https://trusted.example/releases/VERSION/install.sh"
echo "EXPECTED_SHA256  oo-installer.sh" | sha256sum --check -
# Review the downloaded file and obtain explicit user approval before execution.
bash oo-installer.sh

The actual implementation should use an official versioned OOMOL artifact and a digest or signature published through an independently trusted channel.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk: if the install endpoint, CDN, DNS, TLS trust chain, or hosting account is compromised, arbitrary code will run immediately on the user's machine without review.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for "ANY Calendarific request" and "Whenever a task involves Calendarific," which is an extremely broad activation condition. It does not define boundaries, exclusions, or negative examples, so ordinary mentions of Calendarific could trigger the skill unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.