CompanyCam

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:58 AM UTC
• Version: 1.0.2

Overview

The skill fits its CompanyCam purpose, but it needs review because its setup instructions tell users to run an unverified remote installer script.

Before installing, review the oo CLI installation path carefully. Prefer verified package-manager or manually downloaded installer steps from OOMOL, avoid running curl-to-bash or invoke-expression commands without verification, and require explicit confirmation before any CompanyCam write, archive, restore, update, or delete action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:69
• Finding: Unverified Remote Installer Scripts Are Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 69–73 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete vulnerable code snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions pipe remotely retrieved content directly into a command interpreter. Neither command pins the installer to an immutable version nor verifies a cryptographic checksum or signature before execution. The payload executed by the agent can therefore differ from the content that was available when this skill was audited. Although the scripts are hosted under an OOMOL domain and are presented as official installation instructions, domain ownership alone does not guarantee payload integrity. Compromise of the hosting service, DNS or TLS infrastructure, deployment pipeline, or publisher account could turn these commands into an arbitrary-code execution channel. This behavior exceeds the minimum privileges required to operate the declared CompanyCam connector. Connector operations only require an already installed `oo` CLI, while these fallback instructions authorize an external, mutable script to execute unrestricted commands under the invoking user's account. The PowerShell form has the same security properties as the Unix pipeline. The skill also intentionally sends connector action payloads to OOMOL and CompanyCam through `oo connector run`. That network transmission is inherent to the declared remote-service functionality, and the reviewed file states that credentials are injected server-side. No hardcoded credential or separate covert exfiltration mechanism was identified in the available file. ### Attack Path 1. An attacker compromises or gains control over the installer content served from `cli.oomol.com`, its release ...[truncated 1336 chars]
• Remediation: ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` installation instructions. 2. Prefer a trusted platform package manager with a pinned package version and publisher-signature verification. 3. If standalone installers are required, download them to a local file first, pin an immutable release URL, and publish the expected SHA-256 digest through an independently protected channel. 4. Verify the checksum and, where available, a cryptographic publisher signature before execution. 5. Instruct users to inspect the downloaded script before running it and to execute it without administrator privileges unless a documented installation step specifically requires elevation. 6. Pin the CLI version known to be compatible with this skill rather than installing mutable latest content. 7. Keep installation outside routine skill execution. The skill should fail safely and provide verified manual setup guidance when the CLI is absent rather than executing an installer automatically. 8. Document the destination hosts and categories of CompanyCam data transmitted by connector actions so users can make informed decisions before submitting sensitive payloads.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`), which creates a supply-chain and arbitrary code execution risk if the remote host, transport, installer, or distribution pipeline is compromised. Because this appears in a fallback setup path inside an operational skill, users may execute it with little scrutiny when troubleshooting, making exploitation more plausible.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY CompanyCam request," including reading, creating, updating, and deleting data. This is an ambiguous, catch-all activation condition that can overlap with many ordinary CompanyCam-related conversations and does not provide exclusions or narrower trigger constraints.

Static analysis

No suspicious patterns detected.