Circle

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:45 AM UTC
• Version: 1.0.3

Overview

The skill mostly fits its Circle connector purpose, but its setup instructions and command permission grant more authority than users should accept without review.

Review before installing. Use this only if you trust OOMOL and the oo CLI, install the CLI through a verified method rather than piping remote scripts into a shell, and confirm any Circle write action payload before it runs. Prefer a narrower permission profile that only allows Circle connector schema and run commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command pipes a mutable HTTPS response directly into Bash. The remote script is neither version-pinned nor verified using a cryptographic signature or checksum, and the user has no opportunity to inspect the downloaded content before execution. Although the URL uses HTTPS and appears to belong to the CLI vendor, the effective code is controlled by external infrastructure and can change after the Skill has been reviewed. Compromise of the hosting account, web server, DNS, release process, or another part of the delivery chain could cause arbitrary shell commands to be returned. The command is presented as a fallback when `oo` is not installed. The declared tool permission is limited to `Bash(oo *)`, so a conforming runtime should reject direct execution of `curl`; however, the documented installation instruction remains unsafe if copied by the user or executed by a runtime that does not enforce the declared restriction. ### Attack Path 1. The `oo` CLI is absent, and a command fails with `oo: command not found`. 2. The user or Agent follows the documented installation fallback. 3. An attacker compromises or otherwise influences the remote installer delivery path. 4. `curl` retrieves attacker-controlled shell content. 5. Bash executes that content immediately without integrity verification. 6. The payload performs arbitrary actions available to the invoking account. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installation command. This may permit access to files, environment variables, authenticated sessions, developer credentials, and oth ...[truncated 269 chars]
• Remediation: ## Remediation Suggestions - Replace the pipe-to-shell command with a version-pinned release artifact from a verified official source. - Download the artifact to disk without executing it. - Verify a vendor-published cryptographic signature and a checksum obtained through an independently protected channel. - Display or inspect the script before execution. - Prefer a signed operating-system package or package manager with publisher and integrity verification. - Document the exact expected installer version, digest, files created, and privileges required. - Keep installation outside automated Skill execution and require explicit user approval before running any installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` downloads a mutable remote response and sends it directly to `iex` (`Invoke-Expression`). Consequently, the response is interpreted as PowerShell code without version pinning, signature validation, checksum verification, or prior inspection. HTTPS protects the connection in transit under normal conditions but does not establish that the changing server-side script is the same artifact that was reviewed. A compromise of the vendor’s delivery infrastructure or release pipeline could therefore transform this setup command into an arbitrary-code execution channel. The declared `Bash(oo *)` permission does not authorize this PowerShell command in a correctly enforced Agent environment. Nevertheless, it is an unsafe installation instruction for Windows users and for any environment that executes the documented command outside that restriction. ### Attack Path 1. A Windows user discovers that the `oo` CLI is unavailable. 2. The user follows the first-time setup instruction. 3. An attacker gains control over the installer response or its delivery infrastructure. 4. `Invoke-RestMethod` retrieves attacker-controlled PowerShell code. 5. `Invoke-Expression` executes the response immediately. 6. The payload accesses or changes resources available to the invoking Windows account. ### Impact Assessment Successful exploitation grants arbitrary PowerShell execution with the invoking user’s privileges. The resulting access can include local files, environment variables, active credentials, authenticated application state, and network resources accessible to that account. Administrative impact would be possible if the command were run f ...[truncated 152 chars]
• Remediation: ## Remediation Suggestions - Do not pipe web responses to `Invoke-Expression`. - Use a fixed-version, Authenticode-signed installer from a verified publisher. - Download the installer separately and verify both its publisher signature and a vendor-published SHA-256 or stronger digest. - Require explicit user approval after showing the artifact source, version, digest, and requested privileges. - Prefer a trusted Windows package manager that verifies package identity and integrity. - Run installation without administrative privileges unless a documented component strictly requires elevation.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5
• Finding: Overbroad Wildcard Permission for the OOMOL CLI## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Excessive tool authorization and failure to enforce least privilege **Risk Level**: Medium **Vulnerable Code**: ```yaml allowed-tools: [Bash(oo *)] ``` ### Technical Analysis The Skill’s declared purpose only requires inspecting Circle connector schemas and invoking Circle actions. However, `Bash(oo *)` authorizes every argument pattern and subcommand exposed by the `oo` executable rather than limiting execution to the documented Circle operations. This wildcard creates an authorization boundary broader than the Skill’s stated functionality. If task content, connector data, or another untrusted input influences command construction, the Agent could invoke unrelated `oo` subcommands or connectors through the user’s authenticated OOMOL session. The actual effect depends on the installed CLI’s available commands, server-side authorization, connected services, and the user’s OOMOL permissions. The reviewed file does not demonstrate that a specific unrelated operation is executed, but the permission itself exceeds the minimum scope needed for Circle access. ### Attack Path 1. The Skill is loaded with permission to execute any command matching `oo *`. 2. The user’s OOMOL session has access to commands or connectors beyond the Circle operations described by the Skill. 3. Malicious, erroneous, or injected content influences the command or its arguments. 4. The Agent invokes an unrelated or state-changing `oo` operation that still matches the wildcard permission. 5. The CLI performs the operation subject to the user’s broader authenticated privileges. ### Impact Assessment Potential impact is bounded by the commands supported by the installed `oo` CLI and the permissions of the authenticated OOMOL account. It may include unauthorized access to unrelated connectors, disclosure of connected-service data, or execution of state-changing opera ...[truncated 212 chars]
• Remediation: ## Remediation Suggestions - Replace `Bash(oo *)` with the narrowest tool patterns supported by the runtime. - Permit only the required command forms, such as Circle-specific `oo connector schema` and `oo connector run` invocations. - Enforce `circle` as the connector and validate action names against an explicit allowlist. - Validate JSON payloads against the retrieved schema and avoid constructing shell commands through string interpolation. - Separate read actions from state-changing actions and require explicit confirmation for write or destructive operations. - Apply server-side authorization so the Skill’s session can access only the Circle connector and only the operations required for the current request.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which executes a remotely fetched script without prior verification. If the distribution endpoint, DNS, TLS trust chain, or hosting account is compromised, an attacker could achieve arbitrary code execution on the operator's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description uses broad activation language: "Use this skill for ANY Circle request" and "Whenever a task involves Circle, use this skill." For a markdown/manifest-scoped trigger review, this is ambiguous and lacks boundaries or exclusion conditions, increasing the chance of unintended invocation for loosely related Circle mentions.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: At L42, `get_post` is documented as `Get a Circle basic post by ID. [write]`, but L51 states untagged get/list/search actions are reads and L52 says `[write]` means the action changes Circle state. A `get_*` action by name and description is read-only, so the `[write]` tag actively contradicts the documented meaning of the tag and the action description.

Static analysis

No suspicious patterns detected.