Security audit

DocRaptor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using DocRaptor through OOMOL, but its first-time setup tells users or agents to execute remote installer scripts directly without verification.

Review the first-time setup before installing. Prefer installing the oo CLI through a verified, versioned, or package-manager workflow, and avoid running remote scripts directly in a shell. For normal DocRaptor use, confirm any document-creation payload before running it, especially when raw HTML is involved.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:55
Finding: Unverified Remote Installation Scripts Executed Directly by Shells
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:31
Finding: Inline Shell Construction of JSON Payloads Creates a Command-Injection Boundary
Content: View full analysis
" ``` ```bash oo connector run "docraptor" --action "" --data '' --json ``` ### Technical Analysis The instructions demonstrate inserting a generated JSON document directly into a single-quoted shell argument. The available DocRaptor action accepts raw HTML or a public URL. Raw HTML commonly contains apostrophes and may originate from untrusted or user-controlled content. JSON encoding does not make text safe for shell interpolation. JSON strings can legitimately contain single quotes without escaping them because a single quote has no special meaning in JSON. When such JSON is inserted into the documented Bash command, a single quote can terminate the shell argument. Subsequent metacharacters could then be interpreted as shell syntax. Successful exploitation depends on the Agent constructing the command by direct textual interpolation and on the Bash tool's command restrictions permitting the resulting syntax. The same section already documents the safer `@path/to/file.json` interface, but it does not require that interface for content-bearing payloads. ### Attack Path 1. An attacker supplies or influences HTML or another DocRaptor input field. 2. The content contains a single quote followed by shell metacharacters and an attacker-selected command. 3. The Agent serializes the content as JSON and substitutes it directly for `''` in the documented command. 4. The single quote closes the intended shell argument. 5. The shell interprets the remaining text as command syntax. 6. If tool enforcement permits the resulting command, the injected operation executes with the Agent process's user privileges. ### Impact Assessment Potential impact includes execution of arbitr ...[truncated 494 chars]
Remediation: View remediation
" --data @path/to/file.json --json ``` - Create temporary files with restrictive permissions, unpredictable names, and reliable cleanup. - Prefer a structured subprocess interface that passes each argument separately without invoking a shell. - Validate action names against the connector schema rather than incorporating arbitrary user-provided action text. - Treat document HTML and URLs as untrusted input even after JSON serialization. - If inline arguments must be supported, apply a proven shell-escaping routine to the complete argument rather than manual quote replacement. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into bash. That creates a supply-chain and remote code execution risk: if the remote host, transport, or script content is compromised, arbitrary code will run immediately on the user's system without inspection.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description uses expansive activation language like "ANY DocRaptor request" and "Whenever a task involves DocRaptor," which is broad enough to match many ordinary references to DocRaptor without clarifying boundaries. It does not provide scope limits, exclusions, or negative examples to distinguish when this skill should or should not activate.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.