DocuGenerate

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:59 AM UTC
• Version: 1.0.3

Overview

This DocuGenerate skill is mostly coherent, but its fallback setup tells users to run unverified remote installer scripts directly in a shell.

Before installing, review the oo CLI installation path yourself and prefer an official, versioned, verifiable installer if available. Use extra care with delete_document and update_document because they change DocuGenerate data, and confirm exact targets before allowing those actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Remote Shell Script Downloaded and Executed Without Verification## Vulnerability Details **File Location**: `SKILL.md:61` **Vulnerability Type**: Remote payload retrieval and execution through a shell pipeline **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes the response from an external URL directly into Bash. Although HTTPS provides transport encryption and server authentication, it does not pin the script's contents or allow the user to verify the effective payload before execution. The payload can change after the Skill has been reviewed. Installation of the `oo` CLI is relevant to the declared DocuGenerate functionality, but immediate execution of mutable remote content exceeds the minimum privileges and trust required. A compromised hosting account, web server, release pipeline, or domain could replace the installer with arbitrary commands. ### Attack Path 1. The `oo` CLI is absent, causing the documented fallback installation procedure to be used. 2. An attacker compromises the installer host, publishing pipeline, or another component capable of controlling the response from `https://cli.oomol.com/install.sh`. 3. The user or agent runs the documented `curl` pipeline. 4. `curl` retrieves the attacker-controlled response and passes it directly to Bash without inspection, signature validation, checksum verification, or version pinning. 5. Bash executes the payload with all privileges available to the invoking account. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's privileges. The payload could read or modify accessible files, steal credentials and tokens available to the process, install additional software, alter user configuration, establish persistence, or retrieve further payloads. If the command is run from an elevated shell, the impact may extend to system-wide compromise.
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` pipeline. - Prefer a trusted platform package manager or a version-pinned release artifact from the official project repository. - Separate download and execution so the installer can be inspected before it runs. - Publish and verify a cryptographic signature from a documented trusted signing key. - If signature verification is unavailable, pin an expected SHA-256 digest for a specific immutable release before execution. - Run installation with ordinary user privileges whenever possible, requesting elevation only for narrowly scoped operations that require it. - Document the files, network destinations, and system changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Remote PowerShell Script Downloaded and Executed Without Verification## Vulnerability Details **File Location**: `SKILL.md:65` **Vulnerability Type**: Remote payload retrieval and execution through PowerShell **Risk Level**: High ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction retrieves a mutable PowerShell script using `Invoke-RestMethod` (`irm`) and immediately evaluates it using `Invoke-Expression` (`iex`). The content is not pinned, inspected, signed, or checked against a known digest before execution. HTTPS alone does not guarantee that the hosted script remains identical to the version reviewed with this Skill. Because `Invoke-Expression` interprets the response as executable PowerShell, control of the remote response becomes command execution on the user's Windows account. While installing the required CLI is functionally relevant, direct evaluation of remote content is not the least-risk installation mechanism. ### Attack Path 1. A Windows user does not have the `oo` CLI installed and follows the documented setup instruction. 2. An attacker gains control of the installer response through compromise of the host, deployment pipeline, publishing credentials, or associated infrastructure. 3. `Invoke-RestMethod` downloads the modified `install.ps1`. 4. The pipeline supplies the unverified response directly to `Invoke-Expression`. 5. PowerShell executes attacker-selected commands with the invoking process's permissions. ### Impact Assessment Exploitation allows arbitrary PowerShell execution as the invoking user. An attacker could access user-readable documents and credentials, modify files and configuration, download additional malware, or create persistence within the user's permission scope. Execution from an elevated PowerShell session could permit system-wide changes and compromise of other accounts or protected resources.
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Distribute a versioned and signed Windows package through a trusted package manager or immutable release channel. - Download the installer to a local file before execution and validate its Authenticode signature against an explicitly trusted publisher. - Pin the expected version and verify a published SHA-256 digest over a secure, independent trust path. - Avoid administrator execution unless installation explicitly requires it; isolate any elevated operations to the smallest possible scope. - Provide transparent documentation of installer behavior, including filesystem, registry, environment, and network changes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs use of a remote install command that pipes a fetched script directly into a shell, which prevents inspection and creates a supply-chain execution risk. If the hosting endpoint, network path, or installation script is compromised, arbitrary code could run on the user's machine with the user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description is overly broad and directs the agent to use this skill for virtually any mention of DocuGenerate, not just clear API-operation intents. Broad triggers increase the chance of inappropriate invocation, which can expose connected data or enable unintended state-changing operations in contexts where the user only referenced the service casually.

Static analysis

No suspicious patterns detected.