Doppler Marketing Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.2

Overview

The skill is mostly aligned with managing Doppler through OOMOL, but its setup instructions use unverified remote installer scripts that execute directly in a shell.

Before installing, use a safer oo CLI installation path if available: download from official documentation, verify signatures or checksums, and avoid piping remote scripts directly into a shell. Also confirm any write or destructive Doppler action before allowing it to run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64

Finding

Unverified Remote Shell Script Executed Through Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command retrieves a mutable script from an external server and sends it directly to Bash. It does not pin a release, save the script for inspection, or verify a cryptographic checksum or signature before execution.

HTTPS protects the network connection but does not establish payload immutability. A compromised distribution server, CDN, DNS path, TLS key, or publisher account could cause the endpoint to return modified shell code after the Skill has been reviewed. Bash would execute that code immediately with the permissions of the user running the command.

Installing the CLI may be necessary for the declared connector functionality, but executing an unverified remote response is not the minimum privilege or safest installation method required to achieve that purpose.

Attack Path

1. The oo command is unavailable and the first-time setup instructions are followed.
2. An attacker compromises an element of the remote distribution chain or otherwise gains control over the content served by https://cli.oomol.com/install.sh.
3. The attacker replaces or modifies the installer with arbitrary shell commands.
4. curl retrieves the modified response.
5. The pipe passes the response directly to Bash without an integrity or authenticity check.
6. Bash executes the attacker's commands under the invoking user's account.

Impact Assessment

Successful exploitation permits arbitrary command execution with the current user's privileges. Depending on those privileges and the environment, the payload could access readable credentials and files, alter user-owned data and configuration, install additional software, or establish persistence ...[truncated 161 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the pipe-to-shell command with a version-pinned installation procedure from a verified official release.
• Download the installer or binary to disk as a separate step.
• Publish and verify a cryptographic digest, and preferably a signature anchored to a documented publisher key, before execution.
• Stop installation if signature or checksum verification fails.
• Allow the user to inspect the downloaded artifact before running it.
• Execute installation with ordinary user privileges unless a specific operation demonstrably requires elevation.
• Prefer a trusted package manager or signed platform package where available.
• Document the exact destination files, permissions, and system changes made by the installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68

Finding

Unverified Remote PowerShell Script Executed In Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Invoke-RestMethod (irm) retrieves mutable content from an external endpoint, while Invoke-Expression (iex) immediately interprets that content as PowerShell code. The procedure has no pinned release, local review boundary, checksum validation, or signature verification.

Because the effective executable payload is controlled by what the endpoint returns at invocation time, it can differ from the payload available during review. HTTPS alone does not protect against compromise of the publisher or its delivery infrastructure.

Installing the required CLI supports the Skill's declared purpose, but executing an unverified network response through iex exceeds the minimum behavior necessary to install that dependency safely.

Attack Path

1. The oo command is unavailable on a Windows host and the first-time setup instructions are followed.
2. An attacker compromises the installer host, publisher account, CDN, DNS path, TLS material, or another relevant distribution component.
3. The external endpoint serves attacker-controlled PowerShell instead of the expected installer.
4. irm retrieves the malicious response.
5. The pipeline passes it to iex without integrity, signature, or content validation.
6. PowerShell executes the attacker's commands with the invoking user's permissions.

Impact Assessment

Successful exploitation enables arbitrary PowerShell execution under the current user's security context. The payload could read accessible files and credentials, modify user data and configuration, download further components, or create persistence where permitted. Administrator-level compromise would require the command to be ...[truncated 126 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the irm ... | iex installation pattern.
• Pin installation to a specific, documented release.
• Download the installer to a local file before execution.
• Verify both a publisher-provided cryptographic digest and the installer's Authenticode signature.
• Validate that the signing certificate chains to the expected publisher and is valid for code signing.
• Abort on any integrity, signature, or publisher mismatch.
• Run the verified installer without Invoke-Expression and with the least privileges needed.
• Prefer a signed MSI, Microsoft Store package, or trusted package-manager distribution when available.
• Document the files, registry entries, environment changes, and network access expected during installation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into a shell (curl ... | bash), which creates a supply-chain and arbitrary code execution risk if the distribution server, script, DNS, or transport path is compromised. In this skill's context, the danger is elevated because the same skill is intended to manage a marketing platform account, so a compromised installer could steal local environment data, session material, or manipulate subsequent connector operations.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description says to use this skill for "ANY Doppler Marketing Automation request" and "Whenever a task involves Doppler Marketing Automation," which is a very broad activation condition. It does not provide limiting examples or exclusions, so the trigger scope is ambiguous and could overlap with many routine references to Doppler.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.