CrateDB Cloud

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:12 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for CrateDB Cloud read access, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the installer path before installing. Prefer installing the oo CLI from a trusted, versioned source with checksum or signature verification, and only connect a CrateDB Cloud account whose read access you are comfortable exposing through OOMOL's connector.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote Shell Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable script from an external server and pipes it directly into Bash. The payload is not pinned to a version, saved for inspection, validated against a cryptographic checksum, or verified with a trusted signature. The command is presented as a conditional first-time setup step when `oo` is unavailable, rather than as an action performed during every skill invocation. Nevertheless, once invoked, the external server controls the code executed locally. The installer itself is absent from the audited project, so its behavior and future changes cannot be statically reviewed. This creates a remote code-execution and supply-chain channel. Compromise of the hosting infrastructure, release process, domain, or TLS delivery path could substitute arbitrary shell commands. The source domain is consistent with the stated OOMOL provider, but domain consistency alone does not provide payload integrity. ### Attack Path 1. The `oo` command is unavailable and an installation is initiated using the documented setup instruction. 2. `curl` requests the current contents of `https://cli.oomol.com/install.sh`. 3. An attacker who has compromised the hosting service, publishing process, or relevant delivery infrastructure modifies the response. 4. The response is streamed directly into Bash without inspection or integrity verification. 5. The substituted commands execute with the privileges of the user running the installation. ### Impact Assessment A substituted installer could execute arbitrary commands with the invoking user's permissions. Depending on those permissions and the host configuration, it could read or modify accessible files, collect ...[truncated 398 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Prefer a trusted operating-system package manager or a pinned release from the provider's verifiable official repository. - If a standalone installer is necessary: 1. Download it to a local file without executing it. 2. Pin the expected release version and immutable artifact URL. 3. Verify a published SHA-256 or stronger checksum. 4. Verify a cryptographic signature against a documented trusted public key. 5. Allow the user to inspect the script before execution. 6. Require explicit user approval before running it. - Execute installation with ordinary user privileges unless a narrowly defined operation demonstrably requires elevation. - Document the files, network destinations, and system changes expected from the installer. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:67
• Finding: Unverified Remote PowerShell Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 67 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and passes the response directly to `Invoke-Expression` (`iex`). This executes the remote response as PowerShell code without local review, version pinning, checksum validation, or signature verification. Although this is documented as a conditional first-time setup step, the effective code is controlled by an external endpoint after the skill has been reviewed. The remote installer is not included in the project and therefore could not be audited. A compromised endpoint or release process could replace the expected installer with arbitrary PowerShell commands. ### Attack Path 1. The `oo` command is unavailable on a Windows system and the documented setup command is used. 2. `Invoke-RestMethod` retrieves `https://cli.oomol.com/install.ps1`. 3. An attacker with control over the hosting service, publishing pipeline, or applicable delivery infrastructure substitutes malicious PowerShell content. 4. The pipeline sends the response directly to `Invoke-Expression`. 5. PowerShell executes the substituted payload with the current process and user's privileges. ### Impact Assessment A malicious response could execute arbitrary PowerShell commands under the invoking user's account. It could access files and credentials available to that user, modify user configuration, download additional payloads, or create persistence within the user's accessible scope. Administrative compromise is possible if the shell is already elevated or if the user subsequently approves an elevation request, but elevation is not explicitly required by the documented command. The guaranteed ...[truncated 99 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `irm | iex` pattern. - Distribute the CLI through a trusted package manager or a signed, version-pinned release artifact. - If a PowerShell installer must be offered: 1. Download it to a local file. 2. Pin an immutable version. 3. Validate its cryptographic checksum. 4. Require a valid Authenticode or equivalent trusted signature. 5. Present the artifact for inspection. 6. Obtain explicit user approval before execution. - Avoid administrative execution unless a documented installation operation specifically requires it. - Publish the installer's expected system modifications and network behavior. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill recommends `curl ... | bash` to fetch and immediately execute a remote installer script, which creates a supply-chain and arbitrary code execution risk if the host, network path, or distribution endpoint is compromised. Because this appears in a skill that may be followed operationally, it can turn a setup failure into execution of unverified code on the user's machine.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use this skill for "ANY CrateDB Cloud request" and "Whenever a task involves CrateDB Cloud," which is a very broad activation condition. It does not provide scope boundaries or exclusion examples, increasing the chance of unintended invocation for loosely related mentions of CrateDB Cloud.

Static analysis

No suspicious patterns detected.