DumplingAI

• Outcome: Review
• Latest audit: Nov 4, 2026 · 5:28 AM UTC
• Version: 1.0.5

Overview

The DumplingAI workflow is coherent, but its automatic setup can execute unverified remote code and introduce broader agent changes.

Review the setup before enabling this skill. Install a reviewed, version-verified CLI yourself and require approval for installation changes. The publisher documents OO_SKILLS_SYNC_DISABLED=1 to disable automatic skill synchronization; consider enabling it before running oo. [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Remote installer contents and resulting binaries remain unverified; no malicious behavior was established in the bundled file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code performs remote installer execution, not DumplingAI data operations. Nothing in the chunk establishes that the Oomol installer is a supporting dependency for DumplingAI. The mismatch is based on the visible command; the downloaded script's contents and further effects are unknown.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The setup command pipes a remotely supplied script directly into Bash without a pinned version, independent integrity verification, or review; the PowerShell alternative uses the same fetch-and-execute pattern. A compromised distribution endpoint could execute arbitrary code with the invoking user's privileges and access local credentials or files. Restricting installation to a missing-CLI error reduces exposure frequency but does not establish the downloaded code's trustworthiness.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources