Security audit

Deck.co

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for operating Deck.co through OOMOL, but its first-time setup tells users to execute unverified remote installer scripts.

Review the OOMOL CLI installation path before installing. Prefer official, versioned, signed, or checksum-verified installers, and avoid running the provided one-line remote script commands from an elevated shell. After setup, confirm any Deck.co write action payload before allowing it to run.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:60
Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a shell script from an external server and immediately passes it to `bash`. The remote payload is not pinned to a specific version, inspected before execution, or validated with a cryptographic signature or checksum. Although the download domain appears associated with the declared OOMOL service and the instruction is limited to first-time setup after an `oo: command not found` error, the effective code can change after the Skill has been reviewed. Compromise of the hosting infrastructure, deployment pipeline, DNS resolution, or TLS trust chain could therefore turn this command into an arbitrary-code execution path. Installing the required CLI is relevant to the Skill's declared functionality. However, direct execution of mutable remote content exceeds the minimum privilege and trust necessary to install that CLI safely. ### Attack Path 1. The `oo` CLI is unavailable, causing an `oo: command not found` error. 2. The user or Agent follows the first-time setup instruction in `SKILL.md`. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. The downloaded content is streamed directly into `bash` without integrity or authenticity verification beyond HTTPS. 5. If the remote payload or delivery path has been compromised, attacker-controlled shell commands execute with the privileges of the invoking user. ### Impact Assessment A malicious installer could read or modify any data accessible to the invoking account, steal local credentials, alter shell configuration, install additional software, tamper with development environments, or establish persistence. If the command is run from a ...[truncated 349 chars]
Remediation: ## Remediation Suggestions - Do not stream downloaded content directly into a shell. - Distribute the CLI through a trusted platform package manager or provide a version-pinned installer artifact. - Download the artifact to a local file, verify a publisher signature and a checksum obtained through an independently protected channel, and only then execute it. - Pin the expected CLI and installer version rather than retrieving a mutable latest-version script. - Display the source, version, checksum, requested permissions, and intended changes before requesting explicit user approval. - Run installation with ordinary user privileges unless a documented operation strictly requires elevation. - Keep installation outside automatic Skill execution and continue requiring it only after a confirmed missing-command error.

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:64
Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis PowerShell's `Invoke-RestMethod` alias, `irm`, retrieves a script from an external URL and pipes its contents directly to the `Invoke-Expression` alias, `iex`. This evaluates the response as PowerShell code without pinning its version or validating a checksum or digital signature. The command is presented as a conditional first-time installation step and the host appears related to the declared vendor. Nevertheless, its effective behavior is controlled by mutable remote content and cannot be fully determined from the reviewed Skill. A compromised server, release pipeline, DNS route, or TLS trust chain could cause arbitrary PowerShell commands to execute. Installing the connector CLI supports the declared Deck.co integration, but immediate execution of an unverified remote response is not the least-risk means of satisfying that requirement. ### Attack Path 1. The `oo` CLI is missing on a Windows system. 2. The user or Agent follows the documented first-time setup command. 3. `irm` downloads the current response from `https://cli.oomol.com/install.ps1`. 4. The response is passed directly to `iex` without local review, version pinning, checksum verification, or signature validation. 5. If an attacker controls the response or its delivery path, arbitrary PowerShell code runs in the invoking user's security context. ### Impact Assessment Exploitation could expose files and credentials accessible to the current Windows account, alter user or system configuration, download further payloads, tamper with installed tools, or create persistence. Execution from an elevated PowerShell session could permit system-wide changes. No embedded W ...[truncated 198 chars]
Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Publish a versioned installer package signed with a verifiable publisher certificate. - Download the package without executing it, verify its Authenticode signature and a published cryptographic checksum, and then request explicit approval before installation. - Pin the expected version and document the exact files, permissions, and configuration changes performed by the installer. - Avoid administrative execution unless a specific installation operation requires it. - Prefer a trusted Windows package repository with package signing and reproducible version metadata. - Keep setup separate from normal connector actions and invoke it only after a confirmed missing-CLI error.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 94% confidence
Finding: The skill instructs users to install software by piping a remotely fetched script directly into `bash`, which executes unverified code from the network without integrity checking, pinning, or review. In an agent skill context this is more dangerous because the content is operational guidance for automated shell use, so a compromised hosting endpoint, CDN, or MITM in a weak environment could lead to arbitrary code execution on the host.

Static analysis

No suspicious patterns detected.