Cronitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for managing Cronitor through OOMOL, but its setup instructions include unverified remote installer commands that can execute arbitrary code if followed.

Review this skill before installing. The Cronitor connector behavior is disclosed and asks for confirmation before writes or deletes, but do not run the provided remote installer commands unless you independently trust the OOMOL installer source and are comfortable executing downloaded code. Prefer verified or package-manager installation instructions for the oo CLI.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59

Finding

Unverified Remote Installer Download and Immediate Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Vulnerable Code Snippet:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from an external server and pass their contents directly to a command interpreter. The Unix command pipes the HTTP response into Bash, while the Windows command passes the response to PowerShell's Invoke-Expression.

Neither installation path pins a release version, validates a cryptographic checksum, verifies a digital signature, nor gives the user an opportunity to inspect the downloaded script before execution. Consequently, the code that ultimately runs is not the code contained in the reviewed project and may change after this audit.

Although installing the oo CLI supports the declared Cronitor connector functionality, immediate remote-script execution is not the minimum privilege or minimum-risk installation method necessary to provide that functionality. The risk is partially constrained by the instruction to use installation only after an oo: command not found failure. In addition, the declared tool policy is Bash(oo *), which does not itself authorize curl, bash, or PowerShell. Nevertheless, these commands remain unsafe installation guidance and could be executed manually or by an environment that does not strictly enforce the declared tool restriction.

The audit did not establish that the referenced OOMOL installers currently contain malicious content. The vulnerability is the absence of controls ensuring that the remotely supplied content is authentic, immutable, and reviewed before execution.

Attack Path

1. The oo CLI is absent, or an attacker creates cond ...[truncated 1764 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both pipe-to-shell installation commands from the skill instructions.
2. Direct users to a version-pinned release artifact or trusted platform package manager rather than a mutable installer endpoint.
3. Download the artifact without executing it, then verify a vendor-published SHA-256 or stronger digest and a cryptographic signature before installation.
4. Publish checksums and signatures through a separately protected release channel and document the expected signing identity.
5. Allow the user to inspect the downloaded installer and require explicit approval before any installation command runs.
6. Avoid elevated execution. Install only with the minimum permissions required and clearly warn users not to run the installer as root or administrator unless strictly necessary.
7. Keep installation outside the skill's automated workflow. If oo is unavailable, report the missing dependency and provide a verified installation page rather than executing setup automatically.
8. Preserve and enforce the declared Bash(oo *) tool restriction so the skill cannot invoke downloaders, shells, or unrelated commands.
9. If scripted installation is unavoidable, pin the installer to an immutable versioned URL and fail closed when signature, checksum, certificate, or expected-version validation does not succeed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs running a remote installer via 'curl ... | bash', which executes code fetched from the network without verification. If the install endpoint, transport, DNS, or hosting is compromised, this can lead to arbitrary code execution on the user's machine; the risk is heightened because the command is presented as a fallback operational step within the skill.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description says to use this skill for "ANY Cronitor request" and "Whenever a task involves Cronitor," which is a very broad activation condition that could match many incidental mentions of Cronitor. It does not provide limiting context, explicit trigger phrases, or negative examples to clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.