Cartes.io

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:36 AM UTC
• Version: 1.0.2

Overview

The skill fits a Cartes.io connector, but its first-time setup includes unverified remote installer commands that can execute local code.

Install only if you are comfortable using OOMOL as the intermediary for Cartes.io actions and server-side credential handling. Avoid the curl-to-shell or PowerShell iex installer path unless you independently verify the installer source and integrity, and confirm every create, update, or delete payload before allowing the connector action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:72
• Finding: Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 72 and 76 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable shell or PowerShell content from an external server and execute it immediately. Neither command pins the installer to a reviewed version nor verifies a cryptographic signature or checksum before execution. Installation of the `oo` CLI supports the declared Cartes.io integration, and the referenced host is an OOMOL domain. However, piping a network response directly into an interpreter grants that response arbitrary code-execution capability. The effective installer can change after this Skill has been reviewed. A compromise of the hosting infrastructure, publication process, domain, DNS resolution, TLS trust chain, or installer endpoint could therefore turn the documented setup flow into arbitrary command execution. The PowerShell instruction has the same security properties as the shell instruction: `Invoke-RestMethod` retrieves remote content and `Invoke-Expression` executes it without an independent integrity check. ### Attack Path 1. The `oo` command is unavailable, causing the first-time installation instructions to become applicable. 2. An attacker compromises or otherwise gains control over the installer response through the hosting or delivery chain. 3. The user or agent runs the documented `curl | bash` or `irm | iex` command. 4. The interpreter executes the attacker-controlled response with the privileges of the invoking account. 5. The payload can access data and perform operations available to that account, potentially including credential theft, file modification, persistence installation, or further payload retrieval. ## ...[truncated 744 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation patterns. 2. Pin the CLI to a specific reviewed release rather than retrieving a mutable installer endpoint. 3. Download the installer or package to disk without executing it immediately. 4. Publish and verify a cryptographic signature or a checksum obtained through an independently authenticated channel. 5. Prefer a trusted platform package manager or a signed release artifact from the official project repository. 6. Display the resolved version, source, and verification result before installation. 7. Require explicit user approval before executing any downloaded installer. 8. Run installation with ordinary user privileges unless elevated access is demonstrably required. 9. Document a manual inspection procedure and a rollback or uninstallation path. 10. If bootstrap scripts must remain available, fail closed when signature or checksum verification cannot be completed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs use of a remote install command piped directly into a shell (`curl ... | bash`), which is a classic supply-chain and arbitrary code execution risk. If the remote host, transport, or script distribution path is compromised, the agent or user could execute attacker-controlled code on the local system.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger text is overly broad: 'Use this skill for ANY Cartes.io request' and 'Whenever a task involves Cartes.io' can cause the agent to invoke this skill for any mention of Cartes.io without sufficient task disambiguation. That increases the chance of unintended tool use, including routing users into a skill that can perform write and destructive actions when a narrower or read-only flow would be safer.

Static analysis

No suspicious patterns detected.