Devin

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:28 AM UTC
• Version: 1.0.2

Overview

The Devin connector is purpose-aligned, but its setup instructions include running unverified installer scripts from the internet, so users should review it before installing.

Install only if you trust OOMOL's installer delivery path and are comfortable with the setup commands. Prefer reviewing the installer, using a verified release or package manager, and explicitly approving any CLI installation before letting an agent run it. Also review write and terminate actions carefully because they can change or end Devin sessions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Shell Script Executed Through Bash## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a shell script from an external URL and passes the response directly to Bash. The fetched content is not included in the reviewed project and can change after the Skill has been audited. No fixed release version, cryptographic checksum, digital signature, or manual review step is required before execution. Although the URL uses HTTPS and appears to be hosted on the CLI vendor's domain, TLS does not establish that every future version of the script is safe. Compromise of the hosting account, delivery infrastructure, DNS/TLS chain, or installer publication process could turn this command into an arbitrary-code execution channel. Installing the CLI may be relevant to first-time setup, but executing mutable network content without verification exceeds the minimum privilege and trust necessary to perform that installation safely. ### Attack Path 1. The `oo` CLI is unavailable, causing the user or Agent to consult the first-time setup instructions. 2. An attacker compromises the remote installer, its hosting infrastructure, or another relevant delivery component. 3. The attacker modifies `install.sh` to include arbitrary shell commands. 4. `curl` retrieves the attacker-controlled response. 5. The pipeline sends the response directly to Bash without saving, inspecting, pinning, or verifying it. 6. The malicious commands execute with all permissions available to the account that launched the installer. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's privileges. Depending on those privileges and the contents of the remote payload, an attacker co ...[truncated 546 chars]
• Remediation: ## Remediation Suggestions Replace the network-to-shell pipeline with a verifiable installation procedure: 1. Reference a specific, immutable CLI release rather than a mutable installer endpoint. 2. Download the artifact to a local file without executing it. 3. Publish and verify a cryptographic checksum over an authenticated channel. 4. Prefer a vendor signature and validate it against a documented, pinned signing key. 5. Inspect the downloaded installer or use a trusted operating-system package manager before execution. 6. Request explicit user approval before installing software or running installation scripts. 7. Run installation with ordinary user privileges unless a clearly documented step strictly requires elevation. 8. Document the files, directories, network endpoints, and configuration changes created by the installer. A safer conceptual workflow is: ```bash curl -fL -o oo-install.sh "https://trusted.example/releases/pinned-version/install.sh" echo "<published-sha256> oo-install.sh" | sha256sum --check - less oo-install.sh bash oo-install.sh ``` The actual release URL, digest, and signature verification process must come from an authenticated vendor release channel.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote PowerShell Script Executed Through Invoke-Expression## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction uses `Invoke-RestMethod` (`irm`) to retrieve PowerShell source from an external URL and immediately passes the response to `Invoke-Expression` (`iex`). The effective executable payload is therefore controlled outside the audited project and may be changed at any time. The command performs no release pinning, Authenticode validation, checksum verification, or local inspection. HTTPS protects data in transit under normal conditions but does not mitigate compromise of the publisher, server, account, or release infrastructure. `Invoke-Expression` evaluates the downloaded text in the current PowerShell context, giving it direct access to the invoking user's permissions and environment. Installing a required CLI is consistent with first-time setup, but direct evaluation of mutable remote source is not the least-risk method of achieving that purpose. ### Attack Path 1. The `oo` CLI is missing on a Windows host. 2. The user or Agent follows the documented PowerShell installation command. 3. An attacker compromises or replaces the response served as `install.ps1`. 4. `Invoke-RestMethod` downloads the modified PowerShell source. 5. The pipeline supplies that source directly to `Invoke-Expression`. 6. PowerShell executes the attacker-controlled commands with the current process token and all permissions available to the invoking account. ### Impact Assessment Exploitation permits arbitrary PowerShell execution as the invoking user. A malicious installer could access readable documents and configuration, collect credentials available to the process, change user-level settings, download additional payloads, or create pe ...[truncated 422 chars]
• Remediation: ## Remediation Suggestions Remove the `irm | iex` pattern and adopt a signed, pinned installation workflow: 1. Publish a versioned installer through an authenticated release channel. 2. Download the installer to disk without evaluating it. 3. Verify its Authenticode signature and require a trusted, documented publisher. 4. Verify a separately published cryptographic digest for the exact release. 5. Allow inspection before execution and obtain explicit user approval. 6. Execute without administrative elevation unless a documented operation requires it. 7. Fail closed if signature or digest validation fails. 8. Document expected installation effects and required permissions. A safer conceptual workflow is: ```powershell Invoke-WebRequest -Uri "https://trusted.example/releases/pinned-version/install.ps1" -OutFile ".\install.ps1" Get-FileHash ".\install.ps1" -Algorithm SHA256 Get-AuthenticodeSignature ".\install.ps1" # Compare against authenticated vendor information before execution. & ".\install.ps1" ``` Signature status, signer identity, and the cryptographic digest must be validated before the final execution step.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`), which creates a supply-chain and remote code execution risk if the install endpoint is compromised, intercepted, or unexpectedly changed. In a skill context, this is especially dangerous because it normalizes executing unreviewed code during failure handling.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The description says to use this skill for 'ANY Devin request' and for any task that 'involves Devin,' which is an ambiguous and overly broad activation condition for a markdown skill file. It lacks examples of what should not trigger the skill or narrower constraints, increasing the risk of unintended invocation from ordinary Devin-related discussion.

Static analysis

No suspicious patterns detected.