Security audit

Contentful

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Contentful connector, but its first-time setup recommends unverified pipe-to-shell installers, so it should be reviewed before use.

Before installing, use a safer verified installation method for the oo CLI instead of the pipe-to-shell commands, understand that OOMOL will mediate access to your connected Contentful account, and require explicit review before any create or update action runs.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:62
Finding: Unverified Remote Shell Installer Execution on macOS and Linux
Content: View full analysis
Remediation: View remediation
/install.sh" echo " install.sh" | sha256sum --check - less install.sh bash install.sh ``` The version, URL, and digest must be replaced with immutable, publisher-verified values. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:66
Finding: Unverified Remote PowerShell Installer Execution on Windows
Content: View full analysis
Remediation: View remediation
/install.ps1" ` -OutFile ".\install.ps1" Get-FileHash ".\install.ps1" -Algorithm SHA256 Get-AuthenticodeSignature ".\install.ps1" ``` Execution should proceed only if the hash matches a trusted published value and the signature is valid and belongs to the expected publisher. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
## Available actions - `create_entry` — Create a Contentful entry in a specific environment. [write] - `get_current_user` — Get the authenticated Contentful user profile for the current personal access token. - `get_entry` — Get a single Contentful entry by identifier. - `list_content_types` — List Contentful content types available in a specific environment. - `list_entries` — List Contentful entries with common filtering, pagination, and include options.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
## Available actions - `create_entry` — Create a Contentful entry in a specific environment. [write] - `get_current_user` — Get the authenticated Contentful user profile for the current personal access token. - `get_entry` — Get a single Contentful entry by identifier. - `list_content_types` — List Contentful content types available in a specific environment. - `list_entries` — List Contentful entries with common filtering, pagination, and include options.

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: Piping a remotely fetched script directly into bash enables arbitrary code execution if the install endpoint is compromised, intercepted, or serves unexpected content. In this skill, the danger is amplified because the instructions encourage running the command during setup, which could lead an agent or user to execute unverified code on the host.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says to use this skill for "ANY Contentful request" and "Whenever a task involves Contentful," which is an extremely broad activation condition. It does not define boundaries, exclusions, or negative examples, so ordinary mentions of Contentful could trigger the skill unnecessarily.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.