Documenso

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:13 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a read-only Documenso connector, but its setup instructions tell users to execute unverified remote installer scripts.

Review this skill carefully before installing. Its normal Documenso actions are read-only, but do not run the pasted installer commands unless you trust OOMOL's installer source and are comfortable executing remote code; prefer official, versioned, and verifiable installation documentation if available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Shell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely retrieved, mutable script directly into Bash. The script is not pinned to a specific version, downloaded for inspection, or verified using a cryptographic signature or trusted checksum. Although HTTPS protects the connection in transit under normal conditions, it does not protect against compromise of the publisher, hosting infrastructure, DNS resolution, certificate issuance, or the installation endpoint itself. It also does not prevent the publisher-controlled script from changing after the Skill has been reviewed. Installing the CLI may be necessary when it is missing, but immediate execution of unverified remote content is not necessary for the Skill's declared read-only Documenso functionality and exceeds least-privilege expectations. ### Attack Path 1. The `oo` CLI is unavailable, causing the first-time setup instructions to be used. 2. An attacker compromises or gains control over `https://cli.oomol.com/install.sh` or its delivery infrastructure. 3. The attacker replaces or modifies the response with malicious shell commands. 4. `curl` retrieves the attacker-controlled response. 5. The pipe passes the response directly to Bash without verification or review. 6. Bash executes the payload with the privileges of the user running the setup command. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The payload could read or modify accessible files, steal credentials and session material, alter the CLI, install malware, or establish persistence. If the installation command is run from an elevated shell, the payload ...[truncated 108 chars]
• Remediation: ## Remediation Suggestions Remove the pipe-to-shell installation instruction. Prefer a trusted operating-system package manager with a pinned CLI version. If direct installation is unavoidable: 1. Download a versioned artifact to a local file without executing it. 2. Obtain the expected checksum or signature through a separately authenticated release channel. 3. Verify the artifact using a cryptographically secure digest or publisher signature. 4. Allow the user to inspect the script and explicitly approve execution. 5. Execute it without elevated privileges unless a documented installation step strictly requires elevation. 6. Pin the documented installer or release version so the effective payload cannot silently change after review.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote PowerShell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `Invoke-RestMethod` (`irm`) retrieves mutable PowerShell source code from an external endpoint and pipes it directly to `Invoke-Expression` (`iex`). `Invoke-Expression` interprets the response as executable PowerShell code without version pinning, signature validation, checksum verification, or prior inspection. The effective payload can change after the Skill is audited. Compromise of the remote endpoint or its delivery infrastructure would therefore convert this installation instruction into an arbitrary PowerShell execution channel. Immediate remote execution is not required for the Skill's declared read-only Documenso operations. ### Attack Path 1. A Windows user encounters an `oo: command not found` condition and follows the first-time setup instructions. 2. An attacker compromises `https://cli.oomol.com/install.ps1` or the infrastructure used to deliver it. 3. The endpoint returns attacker-controlled PowerShell commands. 4. `Invoke-RestMethod` downloads the malicious response. 5. The pipeline sends that response directly to `Invoke-Expression`. 6. PowerShell executes the payload in the current user's security context. ### Impact Assessment Successful exploitation allows arbitrary PowerShell execution with the invoking user's privileges. An attacker could access user-readable documents and credentials, modify files and configuration, replace local tools, download additional malware, or create persistence mechanisms. Execution from an elevated PowerShell session would expose administrative privileges, although the documented command does not independently bypass access controls or elevate privileges.
• Remediation: ## Remediation Suggestions Remove the `irm | iex` pattern. Use a signed and version-pinned package distributed through a trusted package manager whenever possible. For a direct PowerShell installer: 1. Download the installer to a local file without invoking it. 2. Pin the expected release version and source URL. 3. Verify an Authenticode signature and a published cryptographic checksum. 4. Reject unsigned artifacts, invalid signatures, and checksum mismatches. 5. Present the artifact for inspection and request explicit user approval before execution. 6. Run with standard-user privileges unless a narrowly scoped, documented operation requires elevation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs running a remotely fetched installer via 'curl ... | bash', which executes arbitrary code from the network without integrity verification, pinning, or user review. Because skill content is untrusted and the command is presented as a recovery path, this creates a supply-chain execution risk if the remote host, transport, or distribution path is compromised.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Documenso request" and "Whenever a task involves Documenso," which is a broad activation condition without clear constraints or exclusion examples. This can cause unintended invocation for loosely related mentions of Documenso rather than narrowly defined tasks.

Static analysis

No suspicious patterns detected.