Dialpad WFM

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:59 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for Dialpad WFM, but its setup instructions tell users to execute remote installer scripts without integrity checks.

Review the installer path before using this skill. Prefer installing the oo CLI through a signed or otherwise verifiable package, or manually download and inspect/verify the installer instead of piping it directly into a shell. Also confirm any Dialpad WFM write-like action payloads carefully because the skill operates through your connected OOMOL account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a mutable script from an external URL and pipes it directly into Bash. It does not pin a release, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution. Installing the `oo` CLI is relevant to the Skill's declared connector functionality, and the domain is consistent with the stated vendor. However, direct remote-to-shell execution exceeds the minimum privileges and trust required for installation. The reviewed repository cannot establish what the endpoint currently returns or guarantee that its content will remain trustworthy. ### Attack Path 1. The `oo` command is unavailable, causing the user or agent to follow the first-time setup instructions. 2. An attacker compromises the vendor endpoint, release pipeline, DNS resolution, hosting environment, or another relevant trust-chain component. 3. The attacker modifies `install.sh` to include arbitrary commands. 4. `curl` retrieves the attacker-controlled response. 5. The pipe sends the response directly to Bash without validation. 6. Bash executes the payload with the privileges of the invoking user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. The payload could read files and accessible credentials, modify user-owned data and configuration, install additional software, create persistence where permissions allow, or transmit sensitive information over the network. If the command is run from a privileged shell, the impact could extend to system-wide compromise. The repository does not show that these outcomes currently occur; they represen ...[truncated 89 chars]
• Remediation: ## Remediation Suggestions - Do not pipe downloaded content directly into a shell. - Link to a pinned, versioned release artifact from an official and verifiable source. - Download the artifact to disk without executing it. - Verify a vendor-published cryptographic signature or a securely distributed, pinned SHA-256 checksum before installation. - Prefer a trusted operating-system package manager where signed packages and repository metadata are available. - Display the exact version and source to the user and require explicit approval before installation. - Run installation with ordinary user privileges unless elevated privileges are strictly necessary. - Document how users can inspect the artifact and perform the installation as separate steps.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `Invoke-RestMethod` (`irm`) retrieves a mutable PowerShell script from an external endpoint and passes it directly to `Invoke-Expression` (`iex`). This executes the response as PowerShell code without version pinning, signature validation, checksum verification, or prior inspection. Although installing the `oo` CLI supports the declared functionality and the URL uses a vendor-associated domain, immediate execution of remotely supplied text creates a supply-chain execution boundary broader than necessary. Trust in the repository alone does not establish the integrity of content returned by the endpoint at execution time. ### Attack Path 1. The `oo` command is unavailable on a Windows system, prompting use of the documented setup command. 2. An attacker gains control over the installation endpoint, publishing pipeline, hosting infrastructure, DNS resolution, or another delivery-chain component. 3. The endpoint serves an altered `install.ps1` response containing malicious PowerShell commands. 4. `irm` downloads the response into the active PowerShell session. 5. `iex` immediately interprets and executes the response without integrity verification. 6. The attacker-controlled commands run with the privileges and accessible resources of the invoking PowerShell process. ### Impact Assessment Exploitation can provide arbitrary PowerShell execution as the invoking user. Accessible files, environment variables, credentials, browser or application data, and user configuration may be exposed or modified. The payload could download further components, communicate with external systems, or establish persistence where the account's permissions permit. Execution fro ...[truncated 224 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm ... | iex` installation pattern. - Distribute a version-pinned installer or package through an authenticated, vendor-controlled release channel. - Download the installer separately and validate its Authenticode signature and signer identity before execution. - Publish and verify a cryptographic checksum through an independent authenticated channel. - Prefer a trusted package manager with signed manifests and packages when available. - Require explicit user approval for installation and avoid requesting administrator privileges unless essential. - Provide separate download, verification, and execution commands so users can inspect the artifact before running it.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 99% confidence
• Finding: The skill instructs users to execute a remote installation script directly via `curl ... | bash`, which is a classic supply-chain risk. If the hosting domain, transport path, or script contents are compromised, arbitrary code would run immediately on the user's system with the user's privileges.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use this skill for "ANY Dialpad WFM request" and "Whenever a task involves Dialpad WFM," which is an intentionally broad trigger phrase in a markdown/manifest context. It does not provide limiting conditions, exclusions, or negative examples, so it may overlap with many ordinary references to Dialpad WFM and cause unintended invocation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill labels `get_schedule` as `[write]` even though its description says it retrieves schedule entries. Misclassifying a read action as state-changing can distort downstream safety logic, cause unnecessary confirmations, and more importantly indicate inaccurate action documentation that could lead operators to misunderstand real side effects in this skill.

Static analysis

No suspicious patterns detected.