Dynatrace

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:28 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a Dynatrace reader through OOMOL, but its setup includes unverified remote installer commands and it broadly routes Dynatrace requests through a third party.

Review this skill before installing if your Dynatrace data is sensitive or your organization requires direct API access. Prefer installing the oo CLI through a verified, pinned, or platform-managed method rather than piping remote installer scripts into a shell, and only connect OOMOL to Dynatrace if you are comfortable with OOMOL mediating those requests and responses.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Unverified Remote Installer Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The setup instructions pipe mutable content downloaded from an external server directly into a command interpreter. Both `curl ... | bash` and `irm ... | iex` execute the response without first saving it for inspection or verifying a cryptographic signature, fixed checksum, or pinned release artifact. TLS protects the connection in transit but does not establish that the current installer is immutable or safe. The effective code executed by this Skill can therefore change after the Skill itself has been reviewed. Compromise of the hosting service, DNS infrastructure, TLS or publishing credentials, deployment pipeline, or installer source could turn these commands into an arbitrary-code execution mechanism. This behavior is not necessary for the Skill's declared read-only Dynatrace functionality. Installation should be a separate, explicitly approved administrative action and should use a verifiable artifact. ### Attack Path 1. The `oo` CLI is absent, causing a `command not found` failure. 2. The agent or user follows the documented first-time setup procedure. 3. The shell downloads the current installer from `cli.oomol.com`. 4. A compromised or maliciously modified server response supplies attacker-controlled shell or PowerShell commands. 5. The pipe sends that response directly to `bash` or `iex` without validation. 6. The payload executes with all privileges available to the user running the command. ### Impact Assessment Successful explo ...[truncated 595 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both pipe-to-interpreter installation commands. 2. Pin installation to a specific, immutable CLI release. 3. Download the release artifact without executing it immediately. 4. Verify the artifact using a fixed SHA-256 or stronger digest obtained through a separately trusted channel, preferably together with a vendor signature. 5. Use a trusted package manager or signed platform-native installer where available. 6. Display the artifact source, version, digest, destination, and expected privilege level before installation. 7. Require explicit user approval before performing installation; do not let an agent install software automatically after a command failure. 8. Run installation with ordinary user privileges unless elevation is demonstrably required. 9. Document how to inspect and remove the installed files. A safer Unix workflow would download a version-pinned artifact, verify its signature or fixed checksum, and only then run the verified local file after approval. The PowerShell workflow should follow the same separation between download, verification, and execution. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:4
• Finding: Mandatory Third-Party Routing of Dynatrace Requests<; OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```bash oo connector schema "dynatrace" --action "<action_name>" ``` ```bash oo connector run "dynatrace" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill contains a global routing directive stating that it must be used for any Dynatrace request and must replace direct API access. This is broader than what is required to offer an optional OOMOL connector. It changes the agent's tool-selection behavior and ensures that Dynatrace requests are mediated by an additional third party even when the user has not explicitly selected that processing route. The connector command transmits a JSON request payload through OOMOL and receives Dynatrace results through the same service. Depending on the requested action, the transmitted or returned material can include entity identifiers, selectors, infrastructure names, problem records, operational metadata, and execution identifiers. The file discloses that credentials are injected server-side and does not instruct the agent to collect raw tokens, but it does not provide data-minimization rules, retention information, or an explicit consent step for transmitting potentially sensitive monitoring data. ### Attack Path 1. A user submits a Dyna ...[truncated 1345 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mandatory “ANY Dynatrace request” and “instead of calling the API directly” language with an explicit, opt-in scope. 2. State clearly that OOMOL is a third-party intermediary and identify which request and response fields it processes. 3. Permit direct Dynatrace API access when requested by the user or required by organizational policy. 4. Obtain user confirmation before transmitting sensitive selectors, entity identifiers, problem information, or query results through the connector. 5. Apply data minimization by sending only fields required for the selected action. 6. Document OOMOL's retention, logging, encryption, access-control, deletion, and incident-response practices. 7. Provide allowlisting or redaction controls for sensitive tenant names, host names, entity identifiers, and monitoring records. 8. Preserve the existing prohibition against proactively initiating authentication, and extend it so that connection setup and third-party authorization always require explicit user approval. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software via a remote script piped directly into a shell (`curl ... | bash`), which is a classic supply-chain and arbitrary code execution risk. If the remote host, script, transport, or distribution pipeline is compromised, the agent or user could execute attacker-controlled code immediately.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation guidance is extremely broad and could overlap with many ordinary tasks that merely mention Dynatrace, without clearly limiting when this skill should or should not activate. The file does not provide exclusion conditions or narrower trigger scope to prevent unintended invocation.

Static analysis

No suspicious patterns detected.