Coupontools

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a normal Coupontools connector, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the first-time setup carefully before installing. Prefer installing the oo CLI through a verified package or documented release with integrity checks, and only allow write actions after confirming the exact Coupontools payload and effect.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Installation Scripts Executed Directly by Shell Interpreters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57–61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute their contents using Bash or PowerShell. Neither installation path pins a specific artifact version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded script before execution. The domain is consistent with the declared OOMOL service, and the installation is presented only as a fallback when the `oo` command is unavailable. Nevertheless, the project cannot guarantee the integrity or future behavior of content served from these URLs. The effective executable payload can change after the Skill has been reviewed. This behavior is not necessary for ordinary Coupontools operations when the CLI is already installed. Even during first-time setup, immediate interpreter piping exceeds the minimum privilege and trust required because a safer download, verification, and explicit-approval workflow is available. ### Attack Path 1. The `oo` CLI is unavailable, causing the agent or user to enter the documented first-time setup flow. 2. The agent or user runs one of the provided installation commands. 3. `curl` or `Invoke-RestMethod` retrieves the current script from the external OOMOL server. 4. Bash or `Invoke-Expression` executes the response without integrity validation or prior inspection. 5. If the hosting account, DNS/TLS delivery path, build pipeline, or distribution server is compromised, an attacker substitutes malicious script content. 6. The substituted payload executes with the privileges of the user running the command and can ...[truncated 841 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace direct `curl | bash` and `irm | iex` execution with version-pinned packages distributed through a trusted platform package manager. 2. If scripts must be downloaded, save them to a local file rather than piping them directly into an interpreter. 3. Publish a SHA-256 or stronger checksum over a trusted, authenticated channel and require verification before execution. 4. Cryptographically sign release artifacts and verify the signature against a pinned, documented signing key. 5. Require explicit user approval before executing any downloaded installer, and display the source URL, version, checksum, and destination. 6. Pin the installer to an immutable release URL instead of a mutable `install.sh` or `install.ps1` endpoint. 7. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. 8. Preserve the existing conditional behavior so installation is attempted only when the CLI is genuinely unavailable. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install the CLI via a remote script piped directly into a shell (`curl ... | bash`), which executes network-fetched code without verification. If the install endpoint, transport chain, or hosting account is compromised, arbitrary code could run on the user's machine immediately.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description instructs the agent to use this skill for 'ANY Coupontools request' and 'Whenever a task involves Coupontools,' which is an overly broad routing trigger. Broad triggers can cause the skill to be invoked in contexts it was not specifically validated for, increasing the chance of unsafe action execution or bypassing more appropriate, narrower controls.

Static analysis

No suspicious patterns detected.