Dub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 1.0.4

Overview

The skill is mostly coherent for managing Dub through OOMOL, but its fallback setup tells the agent to execute remote installer scripts directly in a shell.

Install only if you are comfortable routing Dub actions through OOMOL and granting the connected account the needed Dub permissions. Avoid running the pipe-to-shell installer as written; prefer a verified package or download-and-inspect workflow, and carefully confirm exact payloads before write or delete actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66

Finding

Unverified Remote Installation Script Executed Directly by Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-74
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

- **`oo: command not found`** — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands retrieve mutable code from an external server and immediately execute it in a local shell. The instructions do not pin a script version, validate a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution.

Although installing the oo CLI supports the Skill's declared functionality, piping a network response directly into bash or iex is not the minimum-privilege or minimum-trust installation method. The effective code can change after this Skill has been reviewed. Compromise of the hosting service, DNS or TLS infrastructure, deployment pipeline, or upstream account could therefore turn the documented installation command into an arbitrary-code-execution channel.

Attack Path

1. The oo CLI is absent, and a command fails with oo: command not found.
2. The agent or user follows the first-time setup instructions.
3. curl or Invoke-RestMethod retrieves the current installation script from cli.oomol.com.
4. The response is passed directly to bash or Invoke-Expression without integrity verification.
5. A compromised or malicious response executes with the privileges of the invoking account.
6. The payload may read accessible files, steal session credentials, alter local configuration, install persistence, or download additional components.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoki ...[truncated 454 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace direct pipe-to-shell commands with a version-pinned package or release artifact.
2. Download the installer to a local file without executing it automatically.
3. Publish a SHA-256 or stronger checksum through an independently protected channel and verify it before execution.
4. Prefer signed artifacts and verify the publisher's signature against a documented, pinned public key.
5. Display the resolved version, source, checksum, and requested installation location before requesting user approval.
6. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation.
7. Prefer an established package manager with lockable versions and signature verification.
8. For PowerShell, avoid Invoke-Expression; execute a verified local script using an explicit path and appropriate execution-policy controls.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:2

Finding

Mandatory Third-Party Routing of Dub Requests and Payloads

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 2-29
Vulnerability Type: Skill instruction hijacking and unnecessary intermediary data transfer
Risk Level: Medium

Vulnerable Code

yaml

name: oo-dub
description: "Dub (dub.co). Use this skill for ANY Dub request — reading, creating, updating, and deleting data. Whenever a task involves Dub, use this skill instead of calling the API directly."
allowed-tools: [Bash(oo *)]

markdown

Operate **Dub** through your OOMOL-connected account. This skill calls the `dub` connector with the oo CLI; OOMOL injects credentials server-side, so you never handle raw tokens.

bash

oo connector schema "dub" --action "<action_name>"

bash

oo connector run "dub" --action "<action_name>" --data '<json>' --json

Technical Analysis

The Skill instructs the agent to use it for “ANY Dub request” and explicitly prohibits direct API use. This broad instruction changes tool-selection behavior for all Dub-related tasks, including reads, writes, and destructive operations. Request payloads and returned data are consequently routed through the OOMOL connector rather than directly between the user and Dub.

Third-party routing is inherent to the declared OOMOL connector design and is disclosed in the document. No raw-token theft or covert exfiltration mechanism is demonstrated. Nevertheless, making the intermediary mandatory for every Dub request exceeds narrowly scoped activation and increases the number of parties able to process potentially sensitive information. Such information may include short-link destinations, workspace metadata, analytics queries, identifiers, tags, folder names, and create, update, or deletion payloads.

The live schema is also obtained through the intermediary. If the intermediary account, service, or connector definition is compromised, an attacker could influence the fields requested from the user o ...[truncated 1442 chars]

Remediation

View remediation

Remediation Suggestions

1. Narrow activation to requests where the user explicitly chooses the OOMOL-connected workflow.
2. Remove the instruction requiring this Skill for every Dub request and the prohibition against direct API access.
3. Clearly disclose that action payloads and responses pass through OOMOL before any data is transmitted.
4. Obtain explicit consent before routing sensitive workspace data or mutation requests through the intermediary.
5. Document transmitted fields, encryption controls, retention periods, subprocessors, audit logging, and deletion procedures.
6. Request only the minimum Dub scopes needed for each action and separate read-only access from write or deletion privileges.
7. Preserve explicit confirmation for writes and destructive actions, including the exact target and final payload.
8. Where feasible, allow users to select a direct Dub API path to avoid an unnecessary intermediary.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill includes a one-line remote install command that downloads a script over the network and pipes it directly into a shell. If the remote host, distribution path, TLS trust chain, or installation script is compromised, arbitrary code would execute immediately on the user's machine, making this especially dangerous in an automation-oriented skill where operators may follow embedded setup instructions verbatim.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says to use this skill for "ANY Dub request," including all read, create, update, and delete operations. That activation scope is extremely broad and lacks limiting conditions or negative examples, which could cause unintended invocation for routine mentions of Dub.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.