Dart

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:34 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Dart connector, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review this before installing. The Dart task actions are clearly described and destructive actions require confirmation, but avoid running the provided installer pipe commands unless you trust OOMOL's installer path; prefer a verified package, pinned release, checksum, or manual installer review. Also be aware that connecting Dart gives the skill access to read and modify tasks through your connected account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 60–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve scripts from remote URLs and pass the responses directly to command interpreters. Neither command pins an immutable installer version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded content before execution. The effective code is determined by the remote server at execution time and can therefore change after the Skill has been reviewed. Compromise of the hosting domain, release infrastructure, DNS or TLS trust path, or the installer publication process could turn these instructions into an arbitrary-code-execution channel. Installing the required CLI may be relevant to first-time setup, but executing an unverified network response directly is not necessary for that functionality. A version-pinned and cryptographically verified package would achieve the same objective with substantially less privilege and supply-chain exposure. ### Attack Path 1. The `oo` CLI is unavailable, causing the user or agent to follow the first-time setup instructions. 2. An attacker compromises the installer hosting or publication infrastructure, or otherwise causes the installer endpoint to return attacker-controlled script content. 3. On macOS or Linux, `curl` streams that content directly into `bash`; on Windows, `irm` supplies it directly to `iex`. 4. The command interpreter executes the payload without integrity or authenticity verification. 5. The payload performs arbitrary actions using the privileges of the invoking account and may attempt further credential thef ...[truncated 700 chars]
• Remediation: ## Remediation Suggestions - Remove both direct remote-to-shell pipelines. - Distribute the CLI through a trusted platform package manager where practical. - Pin installation instructions to a specific, immutable CLI release rather than a mutable installer endpoint. - Download the installer or release artifact to disk before execution so it can be inspected. - Publish a SHA-256 or stronger checksum through a separately protected channel and verify it before execution. - Prefer vendor-signed artifacts and verify the signature against a documented, pinned signing identity. - Abort installation if checksum or signature verification fails. - Require explicit user approval before downloading or executing installation software. - Run the installer with ordinary user privileges unless a specific, documented operation requires elevation. - Document the expected files, network destinations, and system changes made by the installer.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill recommends installing software via a remote script piped directly into a shell (`curl ... | bash`), which creates a supply-chain and arbitrary code execution risk. If the remote host, transport, or installer is compromised, a user or agent following this guidance could execute attacker-controlled code on the local system.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Dart request" and "Whenever a task involves Dart," which is an extremely broad activation condition. This lacks limiting context or exclusion conditions, increasing the chance of unintended invocation for ordinary Dart-related discussion or tasks that may not require this connector.

Static analysis

No suspicious patterns detected.