CallRail

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:15 AM UTC
• Version: 1.0.2

Overview

This appears to be a real CallRail read-only connector skill, but its broad data-routing instruction and unverified remote installer deserve user review before installation.

Install only if you are comfortable using OOMOL as an intermediary for CallRail data and maintaining a connected CallRail credential there. Avoid running the one-line installer blindly; prefer a pinned, verifiable oo CLI installation method or review the installer before executing it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56
• Finding: Unverified Remote Installer Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 56–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions retrieve mutable content from an external server and immediately execute it using Bash or PowerShell. No immutable version is selected, and no cryptographic checksum, package signature, or publisher signature is verified before execution. Although HTTPS protects the connection in transit under normal conditions, it does not mitigate compromise of the hosting server, publishing account, DNS infrastructure, CDN, certificate authority, or release pipeline. The effective executable payload can also be changed after this Skill has been reviewed. Executing the response directly prevents meaningful inspection and grants the downloaded script all privileges held by the user running the command. Installing a CLI is relevant to the declared functionality, but arbitrary unverified remote execution exceeds the minimum privileges required for read-only CallRail access. ### Attack Path 1. The agent attempts to use the `oo` CLI and receives an `oo: command not found` error. 2. The Skill directs the agent or user to retrieve an installation script from `cli.oomol.com`. 3. An attacker compromises or gains control of the remote script, hosting infrastructure, publishing account, or delivery path. 4. The `curl | bash` or `irm | iex` pipeline passes the attacker-controlled response directly to a command interpreter. 5. The malicious payload executes with the current user's privileges without integrity verification. 6. The payl ...[truncated 726 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all pipe-to-interpreter installation commands, including both `curl | bash` and `irm | iex`. 2. Direct users to a documented installation page rather than allowing the agent to execute an installer automatically. 3. Pin installation instructions to a specific, immutable CLI release and exact artifact. 4. Download the artifact to disk as a separate step so it can be inspected before execution. 5. Publish and verify a cryptographic checksum from an independently protected channel. 6. Require verification of a trusted publisher or package signature before installation. 7. Prefer a reputable operating-system package manager with package signing and version pinning. 8. Require explicit user approval before executing any installer, and clearly state the permissions it requires. 9. Run installation with standard-user privileges unless elevated privileges are demonstrably necessary. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3
• Finding: Mandatory Routing of Potentially Sensitive CallRail Data Through an External Intermediary<; OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```bash oo connector schema "callrail" --action "<action_name>" ``` ```bash oo connector run "callrail" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill contains a broad instruction requiring it to be used for “ANY CallRail request” and explicitly directs the agent away from calling the CallRail API directly. As a result, CallRail request parameters and returned records are processed through the OOMOL connector service. The intermediary behavior is disclosed, and the reviewed file states that credentials are injected server-side. The file does not contain evidence that raw credentials are covertly collected or sent to an unrelated destination. However, mandatory intermediary routing expands the trust boundary and overrides potentially safer direct integrations without requiring explicit user consent. CallRail call and form-submission records may contain customer identifiers, telephone metadata, form content, campaign information, and other business-sensitive data. Sending requests and responses through an additional service creates confidentiality, retention, and service-compromise risks. Requiring this route for every CallRail operation is broader than the minimum necessary when direct, user-approved API access may already be available. ### Attack Path 1. A use ...[truncated 1330 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mandatory “ANY CallRail request” routing directive with an explicit opt-in instruction. 2. Permit a direct CallRail API integration when the user requests it or when an approved direct integration is already configured. 3. Clearly disclose that request parameters and returned CallRail records are processed by OOMOL. 4. Document the exact service endpoints, subprocessors, retention period, logging behavior, encryption controls, and deletion policy. 5. Obtain user confirmation before transmitting sensitive call records, form submissions, or customer-related data through the intermediary. 6. Apply data minimization by requesting and returning only the fields required for the user's task. 7. Provide controls to redact or exclude sensitive fields before transmission. 8. Ensure the connector credential uses the narrowest available CallRail scopes and account access. 9. Establish contractual and technical controls for access logging, retention limits, incident response, and deletion of connector data. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software via a direct remote script pipe to the shell (`curl ... | bash`), which executes unverified code from the network immediately. If the distribution endpoint, transport, or hosting account is compromised, this can lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill description says to use this skill for ANY CallRail request and whenever a task involves CallRail, which is an overly broad trigger. That can cause unintended invocation in loosely related contexts and bypass more precise tool selection or user intent checks, increasing the chance of unnecessary access to CallRail data.

Static analysis

No suspicious patterns detected.