Certn

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:12 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent Certn read connector, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the installer path before installing. Prefer a verified or signed oo CLI installation method, and be aware that once connected, the skill can read Certn cases, users, groups, events, packages, questionnaires, and tags available to the OOMOL-connected account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote Bash Installer Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis This installation command streams mutable content from an external URL directly into a Bash interpreter. It does not pin a release, save the script for review, or verify a cryptographic signature or checksum before execution. HTTPS protects the connection in transit but does not ensure that the installer remains identical to the version originally audited. If the hosting server, publishing account, DNS infrastructure, certificate issuance process, or deployment pipeline is compromised, an attacker can replace the installer with arbitrary shell commands. The changed payload would then execute without an additional validation boundary. Installing the required CLI when it is absent may be legitimate, but immediate pipe-to-shell execution exceeds the minimum mechanism necessary to perform that installation. ### Attack Path 1. The `oo` CLI is unavailable, causing the documented first-time setup path to be used. 2. An attacker compromises or otherwise gains control over the remote installer or its delivery infrastructure. 3. The attacker replaces the installer response with a malicious shell payload. 4. The command retrieves the current response and sends it directly to Bash. 5. Bash executes the attacker-controlled commands without signature, checksum, version, or manual-content verification. ### Impact Assessment A substituted installer can execute arbitrary commands with the permissions of the user running the command. It could read or modify accessible files, collect local credentials, alter user-level configuration, install additional software, or establish persistence. If the command is run from an elevated administrative context, the payload ...[truncated 173 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation method. - Pin installation to a specific, reviewed CLI version rather than a mutable installer endpoint. - Download the release artifact to a local file without executing it. - Verify a publisher signature or a SHA-256 checksum obtained through a separately trusted channel. - Review the downloaded script or package before execution. - Install using the least-privileged account necessary and request explicit user approval before executing an installer. - Prefer a trusted platform package manager or a signed official release package when available.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68
• Finding: Unverified Remote PowerShell Installer Is Executed Through Invoke-Expression## Vulnerability Details **File Location**: `SKILL.md`, line 68 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The command retrieves mutable PowerShell source from an external URL with `Invoke-RestMethod` (`irm`) and immediately executes the response using `Invoke-Expression` (`iex`). No release version is pinned, and no Authenticode signature, checksum, or other integrity control is checked before execution. This design makes the effective executable payload dependent on whatever the remote endpoint serves at invocation time. A compromise of the publisher, hosting environment, DNS or certificate infrastructure, or release pipeline could therefore convert the documented installation command into an arbitrary PowerShell execution channel. Transport encryption alone does not establish that the retrieved script is the specific artifact that was reviewed. ### Attack Path 1. The `oo` CLI is missing on a Windows host. 2. The user or Agent follows the documented PowerShell setup command. 3. An attacker controlling the installer endpoint or its delivery infrastructure serves modified PowerShell content. 4. `Invoke-RestMethod` retrieves the attacker-controlled response. 5. The pipeline passes that response directly to `Invoke-Expression`. 6. The malicious PowerShell code executes without local inspection or cryptographic verification. ### Impact Assessment The payload can perform arbitrary PowerShell operations available to the invoking user, including accessing files and credentials, changing user configuration, downloading further payloads, or creating persistence within that user's privilege boundary. If PowerShell is running with administrative rights, the retrieved code can act with those administrative rights. The audited file does not prove au ...[truncated 102 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Pin a specific reviewed version of the CLI. - Download the installer to disk without automatically executing it. - Require a valid Authenticode publisher signature or verify a pinned cryptographic checksum before execution. - Use a signed MSI, a trusted Windows package manager, or another verifiable official distribution mechanism where possible. - Display the artifact source, version, and verification result and obtain explicit user approval before installation. - Run the installer with the minimum permissions required rather than instructing users to launch an elevated shell by default.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill recommends installing software via a remote script piped directly into a shell (`curl ... | bash`), which executes network-fetched code without prior verification. If the install endpoint, transport, hosting account, or upstream distribution is compromised, an attacker could achieve arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This invocation guidance is broad enough to match many routine references to Certn, with no negative examples or constraints describing when the skill should not activate. That increases the risk of unintended invocation whenever Certn is merely mentioned rather than actually needed.

Static analysis

No suspicious patterns detected.