Detrack

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:56 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent Detrack connector, but its setup instructions tell users to run unverified internet-downloaded installer scripts, so it needs review before installation.

Review the oo CLI installation path before installing. Prefer a pinned, signed, or checksum-verified installer from the vendor, and do not let the agent run setup automatically. For normal Detrack use, confirm exact payloads before create/update actions and give explicit approval before delete actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Shell Script Execution During CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a shell script from an external URL and immediately passes it to `bash`. The script is not pinned to an immutable release, downloaded for inspection, or verified using a cryptographic signature or trusted checksum. Consequently, the code executed by this Skill is not limited to the content reviewed in the project. It can change whenever the remote resource changes. Although the URL appears to belong to the CLI vendor, this does not eliminate the risks of a compromised vendor account, web server, DNS or delivery infrastructure, or software-release pipeline. Installing the `oo` CLI is related to the declared Detrack integration, but executing mutable remote content without verification exceeds the minimum privileges and trust necessary to perform that installation safely. ### Attack Path 1. The agent attempts to use the Detrack connector and discovers that the `oo` command is unavailable. 2. The agent follows the documented first-time setup procedure. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. The pipe sends the response directly to `bash` without presenting it for review or validating its provenance. 5. If the remote endpoint or delivery chain has been compromised, attacker-controlled shell commands execute with the privileges of the user or agent process. 6. Those commands may access files available to that account, alter the local environment, steal accessible credentials, install additional software, or establish persistence. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the installation command. The precise scope depends on that account's ...[truncated 636 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation pattern. 2. Pin installation instructions to a specific, immutable CLI release. 3. Download the installer or release artifact without executing it immediately. 4. Verify a vendor-published cryptographic signature or checksum obtained through an independently trusted channel. 5. Prefer a trusted platform package manager with package-signing and version-pinning support. 6. Display the source, version, expected checksum, and intended changes before execution. 7. Require explicit user approval before installing software or running an installer. 8. Run installation with ordinary user privileges unless a narrowly defined step genuinely requires elevation. 9. Document the files, directories, and network endpoints the installer is expected to access. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote PowerShell Script Execution During CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:65` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The PowerShell setup command retrieves a script from an external server using `Invoke-RestMethod` (`irm`) and immediately evaluates the response through `Invoke-Expression` (`iex`). There is no immutable version pin, local inspection step, Authenticode validation, cryptographic signature verification, or trusted checksum validation. `Invoke-Expression` treats the downloaded response as executable PowerShell code. Therefore, the effective payload can change after the Skill has been reviewed. Trust in the apparent vendor domain alone is insufficient to protect against compromise of the hosting account, server, DNS or delivery infrastructure, or release pipeline. The Skill needs a connector client to provide its stated functionality, but arbitrary evaluation of mutable network content is not a least-trust installation mechanism. ### Attack Path 1. The agent attempts to use the Detrack connector on Windows and finds that the `oo` CLI is not installed. 2. The agent follows the first-time setup instructions. 3. `Invoke-RestMethod` retrieves the current response from `https://cli.oomol.com/install.ps1`. 4. The response is piped directly to `Invoke-Expression`. 5. If an attacker controls or has compromised the remote content or its delivery path, the response executes as attacker-supplied PowerShell code. 6. The payload runs with the current PowerShell process's privileges and can perform any operation permitted to that account. ### Impact Assessment Successful exploitation results in arbitrary PowerShell execution under the invoking user's security context. Potential consequences include: - Access to user-readable files and locally available application data. - Theft of acces ...[truncated 523 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `irm | iex` pattern. 2. Pin the CLI to a specific, immutable release. 3. Download the PowerShell script or signed release package to disk without executing it. 4. Validate an Authenticode signature and expected publisher identity, or verify a cryptographic checksum distributed through an independent trusted channel. 5. Prefer a signed package delivered through a trusted Windows package manager. 6. Allow the user to inspect the downloaded artifact before execution. 7. Require explicit user authorization before installing software. 8. Avoid administrator privileges unless a documented installation operation strictly requires them. 9. Fail closed if signature, publisher, version, or checksum validation does not succeed. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell, which is a classic supply-chain execution risk. If the install host, transport, or published script is compromised, arbitrary code would run immediately on the user's machine with the user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Detrack request" and "Whenever a task involves Detrack," which is a very broad activation condition. It does not provide boundaries, exclusions, or negative examples to clarify when this skill should or should not be invoked.

Static analysis

No suspicious patterns detected.