Security audit

Confluence

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Confluence connector, but its setup path includes direct execution of remote installer scripts and all Confluence activity is routed through OOMOL.

Review this before installing if your Confluence contains confidential data. Prefer installing the `oo` CLI through a verified package or reviewed installer rather than running the pipe-to-shell commands, and use a least-privilege Confluence connection with explicit confirmation for writes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:59
Finding: Unverified Remote Installation Scripts Executed Directly by Shells
Content: View full analysis
Remediation: View remediation
oo-installer.sh" | sha256sum --check less oo-installer.sh bash oo-installer.sh ``` The actual release URL and checksum must be fixed to a reviewed version and obtained from a trusted source. ]]>

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: Mandatory Third-Party Routing of Potentially Sensitive Confluence Content
Content: View full analysis
" --data '' --json ``` ### Technical Analysis The Skill instructs the agent to use OOMOL infrastructure for every Confluence request instead of allowing direct interaction with Confluence. Payloads sent through `oo connector run` can include private page contents, titles, search queries, space metadata, and proposed updates. The third-party connector is disclosed, and the reviewed file does not show raw Confluence tokens being collected locally. Nevertheless, the mandatory routing instruction introduces an additional trust boundary and can expose sensitive organizational content and operation metadata to infrastructure outside Confluence. The broad instruction to use the Skill for “ANY” Confluence request also overrides a narrower or more privacy-preserving direct API path. The reviewed documentation does not provide details about payload minimization, retention, logging, encryption beyond transport, tenant isolation, or user consent for transmitting page content through OOMOL. This access pattern may therefore exceed minimum privilege when direct Confluence access would satisfy the task. ### Attack Path 1. A user asks the agent to read, search, create, or update Confluence content. 2. The broad Skill instruc ...[truncated 1273 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The skill instructs the agent to install missing tooling by piping a remotely fetched script directly into bash, which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, or hosting account is compromised, arbitrary code would execute immediately on the local system without review; in an agent skill, this is more dangerous because the workflow may normalize or automate shell execution.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Static analysis

No suspicious patterns detected.