Daffy

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:59 AM UTC
• Version: 1.0.3

Overview

This Daffy connector skill is mostly read-only and purpose-aligned, but its first-time setup tells an agent to run mutable remote installer scripts without verification or explicit approval.

Review the first-time setup carefully before installing. Use the skill only if you are comfortable with OOMOL mediating Daffy access, and avoid running the shown remote installer pipelines unless you can independently verify the installer or use a safer package installation method.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Remote Shell Script Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:64` **Vulnerability Type**: Remote payload retrieval and execution through `curl | bash` **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command streams a mutable script from an external server directly into Bash. The retrieved payload is neither version-pinned nor verified using a cryptographic checksum or signature. Although HTTPS protects the connection in transit, it does not ensure that the server will continue serving the same script that was reviewed. Consequently, compromise of `cli.oomol.com`, its hosting infrastructure, DNS resolution, release process, or signing credentials could cause arbitrary attacker-controlled commands to execute locally. The script runs with all privileges available to the invoking shell. This behavior exceeds the minimum privileges needed to document how the Daffy connector is used because installation can instead be delegated to the user through a verifiable package or release artifact. ### Attack Path 1. The `oo` command is unavailable and an agent or user follows the first-time setup instructions. 2. An attacker compromises the remote installation endpoint or its software-delivery supply chain. 3. The endpoint returns a modified `install.sh` containing attacker-controlled commands. 4. `curl` streams the response directly to Bash without local inspection or integrity verification. 5. Bash executes the attacker's payload with the permissions of the invoking account. 6. The payload can access files, credentials, and network resources available to that account and may attempt further compromise or persistence. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's privileges. A normal user invocation could expose that user's files, environment variables, credentials, authentication ...[truncated 297 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` execution pipeline. - Prefer installation through an official package manager with a pinned package version and authenticated repository metadata. - If a standalone installer is necessary, download a version-specific artifact to disk without executing it immediately. - Publish and verify a cryptographic signature or a checksum obtained through a separately trusted channel. - Allow the user to inspect the downloaded script before execution. - Require explicit user approval before running any installer. - Execute installation with the least privileged account possible and do not request administrative privileges unless a documented installation step strictly requires them. - Pin the expected CLI release and trusted artifact URL so the reviewed installation payload cannot silently change.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68
• Finding: Remote PowerShell Script Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:68` **Vulnerability Type**: Remote payload retrieval and execution through `Invoke-RestMethod | Invoke-Expression` **Risk Level**: Critical ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis In PowerShell, `irm` is an alias for `Invoke-RestMethod`, while `iex` is an alias for `Invoke-Expression`. This pipeline retrieves text from an external server and immediately interprets it as PowerShell code. The payload is mutable and is not pinned to a release, checked against a trusted hash, or validated through a cryptographic signature. HTTPS alone does not establish that the downloaded script is identical to a previously reviewed version. A compromise of the distribution endpoint or its supply chain would therefore convert this installation instruction into an arbitrary code-execution channel. The use of `Invoke-Expression` also removes the opportunity to inspect the script before it runs. ### Attack Path 1. The `oo` command is unavailable on a Windows host and the first-time setup instructions are followed. 2. An attacker gains control of the installation endpoint or another trusted component in its delivery pipeline. 3. The attacker causes `install.ps1` to contain malicious PowerShell commands. 4. `Invoke-RestMethod` downloads the modified content. 5. The pipeline passes that content directly to `Invoke-Expression`. 6. PowerShell executes the commands with the invoking process's privileges, allowing access to the user's local resources and potentially the wider system. ### Impact Assessment Exploitation permits arbitrary PowerShell execution under the invoking user's security context. Potential consequences include theft of accessible files and credentials, modification of user data, execution of additional payloads, and access to network resources available to the account. If launched from an elevated Pow ...[truncated 234 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pipeline and avoid `Invoke-Expression` for remotely obtained content. - Distribute the CLI using a signed, version-pinned installer or an authenticated package manager. - When direct download is unavoidable, save the installer to disk first and verify its Authenticode signature and a published cryptographic checksum. - Obtain verification metadata through a separately trusted channel. - Present the artifact and intended effects to the user and require explicit approval before execution. - Run the installer without elevation by default; request elevated privileges only for narrowly documented operations that require them. - Pin the expected CLI version and artifact URL to prevent silent changes to the effective installation payload.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This creates a supply-chain and remote code execution risk: if the install endpoint is compromised, modified, or intercepted, arbitrary commands would run immediately on the host with the user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description says to use this skill for "ANY Daffy request" and "Whenever a task involves Daffy, use this skill," which is extremely broad and lacks boundaries or exclusion conditions. This can overlap with many ordinary references to Daffy and does not specify what kinds of tasks should not invoke the skill.

Static analysis

No suspicious patterns detected.