Security audit

CallPage

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent CallPage connector, but its setup instructions include unverified remote installer commands that could execute arbitrary code on the user's machine.

Review this skill before installing. Its normal CallPage actions are scoped and disclosed, but do not let an agent run the installer snippets automatically; install the oo CLI only from a trusted, verified source and confirm any CallPage write action before it runs.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:58
Finding: Unverified Remote Installer Download and Immediate Shell Execution
Content: View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis Both installation commands retrieve mutable content from an external URL and pass the response directly to a command interpreter. The downloaded payload is executed without: - Pinning an installer version or immutable artifact. - Verifying a cryptographic signature or checksum. - Saving and reviewing the installer before execution. - Obtaining explicit approval immediately before executing the downloaded code. HTTPS protects the connection in transit but does not address compromise of the installer host, publishing account, CDN, DNS infrastructure, or release pipeline. The effective code can also change after the Skill package has been reviewed. The behavior is presented as a fallback when the `oo` command is unavailable rather than as part of ordinary CallPage operations. Executing arbitrary installer code also exceeds the declared `allowed-tools: [Bash(oo *)]` boundary: the stated capability permits `oo` commands, while the installation instructions invoke `curl`, `bash`, PowerShell `irm`, and `iex`. The documented CallPage connector necessarily sends user-requested CallPage data through OOMOL. However, the audited file contains no evidence that this intended connector traffic performs undeclared exfiltration or directly exposes raw credentials. The confirmed issue is the unverified installer execution channel. ### Attack Path 1. A user asks the agent to perform a CallPage operation. 2. The agent attempts to use `oo`, but the execut ...[truncated 1163 chars]
Remediation: View remediation
/ ``` 5. Verify the artifact against a trusted, separately published cryptographic signature or pinned SHA-256 checksum before execution. 6. Display the artifact source, version, expected checksum, requested privileges, and intended filesystem changes to the user before requesting approval. 7. Execute only the verified local artifact and avoid elevated privileges unless they are demonstrably required. 8. Keep installation outside the Skill’s routine execution flow. The Skill should normally invoke only commands covered by its declared `Bash(oo *)` permission. 9. Apply equivalent protections on Windows: download a versioned installer, validate an Authenticode signature or pinned digest, obtain explicit approval, and only then execute the local verified file. 10. If installation support must remain, document a failure-safe process that aborts on download, signature, checksum, ownership, or permission anomalies. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to install software via a remote script piped directly into a shell, which allows arbitrary code from the fetched URL to execute immediately on the host. If the install server, transport, or script supply chain is compromised, this becomes a straightforward remote code execution path, and the skill context increases risk because it presents the command as a supported remediation step.
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This activation guidance is broad enough to match many ordinary tasks that merely mention CallPage, without clarifying scope, exclusions, or concrete trigger examples. That ambiguity increases the chance of unintended invocation instead of narrower, task-specific routing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.