E2B

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:38 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for managing E2B through OOMOL, but its first-time setup tells users to execute unverified remote installer scripts directly in a shell.

Review the installer step before use. Prefer installing oo from an official, verifiable package or downloading and inspecting the installer first; do not let an agent run the curl-to-bash or Invoke-Expression command automatically. Also confirm any create or delete sandbox action before execution.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical The first-time setup instructions execute mutable remote installation scripts directly in the user's shell: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both installation commands combine remote content retrieval with immediate interpreter execution. The Unix command pipes the HTTP response directly to Bash, while the PowerShell command passes the response to `Invoke-Expression`. The downloaded scripts are not pinned to a reviewed version, saved for inspection, or verified with a cryptographic checksum or digital signature. Consequently, the effective code can change after the Skill itself has been reviewed. Compromise of the installer hosting infrastructure, publication pipeline, domain, or trusted network path could turn these instructions into an arbitrary-code execution channel. Installing the required CLI may support the declared E2B connector functionality, but executing an unverified, mutable response directly exceeds the minimum safe installation approach. The project contains no local installer whose behavior can be audited. ### Attack Path 1. The agent attempts an E2B operation and receives an `oo: command not found` error. 2. Following the documented fallback, the agent runs the applicable installation command. 3. The command retrieves the current script from `cli.oomol.com`. 4. A compromised hosting or release pipeline supplies attacker-controlled script content. 5. Bash or PowerShell executes that content immediately, without integrity verification or prior review. 6. The payload performs arbitrary actions with the permissions available to the agent process. ### Impact Assessment A substitu ...[truncated 708 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | bash` and `irm | iex` installation patterns. 2. Direct users to a trusted, version-pinned package-manager entry or a specific official release artifact. 3. Download the artifact to disk without executing it. 4. Verify a vendor-published cryptographic signature and a version-specific SHA-256 digest before execution. 5. Permit the user to inspect the downloaded installer and require explicit approval before running it. 6. Execute installation with ordinary user privileges unless elevated access is demonstrably required. 7. Pin the CLI version supported by the Skill and document a controlled upgrade procedure. 8. If automated installation is unavoidable, vendor a reviewed installer in the package or use a signed package repository with integrity and provenance verification.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`), which creates a supply-chain and remote code execution risk if the distribution endpoint, network path, or install script is compromised. In the context of a skill that may be executed by an agent or followed by users, this is more dangerous because it normalizes executing unverified external code as part of routine setup.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest says to use this skill for "ANY E2B request" involving reading, creating, updating, and deleting data, which is extremely broad and lacks constraints or negative examples. This could overlap with many routine references to E2B and does not clearly define when the skill should or should not activate.

Static analysis

No suspicious patterns detected.