Security audit

Customer.io

Security checks for vulnerabilities and agentic risk

Overview

This Customer.io skill is coherent, but it needs review because it can change customer data without the promised confirmation boundary and includes unsafe installer commands.

Review before installing. Use a sandbox or least-privileged Customer.io connection, require explicit approval for every customer creation, update, event track, suppress, unsuppress, merge, or delete action, and avoid the pipe-to-shell installer path unless you have independently verified the OOMOL CLI installer source and integrity.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:61
Finding: Unverified Remote Installer Download and Immediate Shell Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61-65` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download mutable content from an external server and immediately execute it using Bash or PowerShell. There is no version pinning, cryptographic signature verification, checksum validation, or opportunity to inspect the downloaded installer before execution. The domain is consistent with the declared OOMOL service, but domain consistency alone does not establish the integrity of the script returned at execution time. If the website, hosting infrastructure, DNS configuration, TLS termination, or script publication process is compromised, the downloaded response can be replaced with arbitrary commands after the skill has passed review. This behavior exceeds the minimum privileges required to explain how to install a command-line client because safer installation mechanisms can download a fixed release, verify its integrity, and only then execute or install it. ### Attack Path 1. The `oo` command is unavailable, causing the agent or user to follow the first-time setup instructions. 2. The system retrieves `install.sh` or `install.ps1` from the remote OOMOL server. 3. An attacker who has compromised the relevant delivery infrastructure modifies the installer response. 4. The pipeline passes the response directly to Bash or PowerShell without integrity validation. 5. The attacker's commands execute with all privileges available to the user running the installation command. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking user's account. Depending on that account's permissions and the malicious payload, the attack ...[truncated 514 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not pipe network responses directly into Bash, PowerShell, or another interpreter. - Refer users to a version-pinned release artifact from the documented upstream repository. - Publish SHA-256 or stronger checksums through a separately protected channel and require verification before installation. - Prefer cryptographically signed packages and verify the publisher signature. - Download the installer to a local file, inspect or verify it, and execute it only after successful validation. - Use an operating-system package manager with signed metadata where available. - Document that installation must run without administrator privileges unless a specific installation step demonstrably requires elevation. - Pin the expected CLI version so the reviewed installation behavior cannot silently change. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:43
Finding: State-Changing Customer.io Actions Are Incorrectly Classified as Safe Reads<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:43-54` **Vulnerability Type**: Unsafe authorization and confirmation policy **Risk Level**: High ### Vulnerable Code ```text - `delete_customer` — Delete a Customer.io person and their information through the Track API. [destructive] - `identify_customer` — Add or update a Customer.io person through the Track API. - `merge_customers` — Merge two Customer.io people, keeping the primary profile and deleting the secondary profile. [write] - `suppress_customer` — Delete and suppress a Customer.io person identifier so it cannot be re-added until unsuppressed. - `track_anonymous_event` — Track an event for an anonymous person in Customer.io. - `track_customer_event` — Track an event associated with an identified Customer.io person. - `unsuppress_customer` — Unsuppress a Customer.io person identifier so a new profile can be created later. ``` ```text - Untagged actions are reads (get / list / search) — safe to run directly. - **Actions tagged `[write]` change Customer.io state — confirm the exact payload and effect with the user before running.** - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval first.** ``` ### Technical Analysis The safety policy declares every untagged action to be a read operation that is safe to execute directly. However, several untagged actions explicitly alter remote Customer.io state: - `identify_customer` adds or updates a customer. - `suppress_customer` deletes and suppresses an identifier. - `track_anonymous_event` creates event data. - `track_customer_event` creates event data associated with a customer. - `unsuppress_customer` changes suppression state. The action metadata therefore contradicts the documented safety rule. An agent following these instructions may execute mutating or destructive operations without showing the exact payload and obtaining user confirmation. In particular, `suppress_customer ...[truncated 1816 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Mark `identify_customer`, `track_anonymous_event`, `track_customer_event`, and `unsuppress_customer` as `[write]`. - Mark `suppress_customer` as `[destructive]` because it deletes and suppresses an identifier. - Require the agent to display the exact target, payload, and expected effect before every state-changing operation. - Require explicit user approval immediately before executing destructive actions. - Do not infer that an action is read-only merely because a tag is absent. Use an explicit allowlist of verified read-only actions. - Validate action semantics against the live connector schema and documentation before execution. - For event-tracking operations, warn users that events may trigger campaigns or downstream automation. - Minimize transmitted data to fields required by the authoritative schema and the user's stated task. - Add tests or linting that reject action lists where mutating verbs or descriptions are left untagged. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The safety section incorrectly states that untagged actions are reads, but the listed untagged actions include state-changing operations such as identify_customer, suppress_customer, track_anonymous_event, track_customer_event, and unsuppress_customer. This can cause an agent to execute writes without confirmation, leading to unauthorized profile changes, event injection, suppression changes, or data integrity issues in Customer.io.

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 95% confidence
Finding: The skill instructs the agent to install software via a curl-to-shell pipeline, which executes remote code directly without verification. If followed, this creates a supply-chain execution path where a compromised endpoint, MITM, or malicious script update could result in arbitrary code execution on the host.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The invocation text says to use this skill for ANY Customer.io request, which is overly broad and encourages automatic routing of all Customer.io-related tasks into a high-privilege skill that can perform destructive actions. In an agentic environment, broad triggering increases the chance of inappropriate tool selection, accidental writes, and use without sufficient task scoping or confirmation.

Static analysis

No suspicious patterns detected.