Emelia

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:39 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent read-only Emelia connector, but its first-time setup tells users to run remote installer scripts directly, which warrants review before installation.

Install only if you trust OOMOL and the oo CLI installer. Prefer official signed or package-manager installation instructions, avoid running the pipe-to-shell commands from an elevated shell, and remember the skill can read Emelia campaign, contact, provider, and webhook data through your connected account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Shell Script Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote payload retrieval and execution through `curl | bash` **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a mutable script from an external URL and pipes it directly into Bash. The script is executed without version pinning, cryptographic signature verification, checksum validation, or local inspection. The effective code is not contained in the audited project and may change after the Skill has been reviewed. Trust therefore extends to the remote hosting infrastructure, DNS and TLS path, and every future version of the installation script. Although the hostname is associated with the declared OOMOL service, domain association alone does not guarantee the integrity of the retrieved payload. This behavior exceeds the minimum privileges required for the Skill's declared functionality. Its ordinary functionality only requires invoking an already installed `oo` CLI to perform read-only Emelia connector operations. Installing executable software is a separate, higher-risk operation and should not be performed through an unverified pipe-to-shell command. ### Attack Path 1. The `oo` CLI is absent, causing an Agent or user to follow the first-time setup instructions. 2. The command retrieves the current content of `https://cli.oomol.com/install.sh`. 3. Bash begins executing the response directly, without first saving or validating it. 4. If the remote script, hosting service, or delivery path has been compromised, attacker-controlled shell commands execute with the invoking user's privileges. 5. Those commands can access files and credentials available to that user, alter the local environment, install additional software, or attempt persistence. ### Impact Assessment A malicious remote payload could obtain arbitrary command execu ...[truncated 407 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | bash` installation instruction from Agent-executable guidance. - Direct users to a documented package manager or a version-pinned release artifact from a verified publisher. - Download the installer to a local file rather than executing the HTTP response directly. - Publish and require verification of a cryptographic signature or a trusted SHA-256 checksum before execution. - Permit users to inspect the downloaded script before running it. - Keep CLI installation separate from normal Skill execution and require explicit user approval for software installation. - Avoid requesting elevated privileges unless a documented installation step strictly requires them. - Prefer an allowlisted, fixed CLI version to reduce exposure to unexpected upstream changes. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote PowerShell Script Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Remote payload retrieval and execution through `Invoke-Expression` **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The PowerShell setup command uses `Invoke-RestMethod` (`irm`) to retrieve a mutable script and sends the response directly to `Invoke-Expression` (`iex`). This evaluates the downloaded text as PowerShell code without version pinning, Authenticode verification, checksum validation, or prior inspection. Because the effective payload remains outside the audited project, its behavior can change independently of the reviewed `SKILL.md`. Compromise of the remote installer or its delivery infrastructure would provide a direct code-execution path. The fact that the download domain appears related to the declared service does not replace payload integrity verification. Software installation is also not necessary for each Emelia read operation. The Skill declares `oo` connector calls as its functional behavior and states that installation is only a fallback when the CLI is missing. Even as a fallback, directly evaluating network content grants substantially more capability than necessary. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. An Agent or user follows the first-time setup instruction. 3. `Invoke-RestMethod` downloads the current content of `https://cli.oomol.com/install.ps1`. 4. `Invoke-Expression` immediately evaluates the returned content in the active PowerShell session. 5. A compromised or malicious response executes arbitrary PowerShell commands with the invoking user's privileges. 6. The payload could read accessible data, obtain user-level credentials, modify PowerShell or user configuration, download additional components, or attempt persistence. ### Impact Assessment Successful exploitation provides arbitr ...[truncated 438 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `irm ... | iex` installation pattern. - Provide a version-pinned, signed installer or package from a verified release channel. - Save the installer locally before execution and verify its Authenticode signature and publisher. - Publish a SHA-256 checksum through an independently protected release channel and require validation. - Allow inspection of the downloaded script before it is run. - Require explicit user authorization before installing software or changing the local environment. - Run installation with ordinary user privileges whenever possible and document any strictly necessary privilege escalation. - Keep installation outside routine Skill execution so connector reads cannot automatically trigger remote code execution. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`), which executes network-fetched code without prior verification. If the hosting endpoint, transport chain, or published installer is compromised, this can lead to arbitrary code execution on the local machine running the skill setup.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger text says to use this skill for ANY Emelia request and whenever a task involves Emelia, which is overly broad and can cause the agent to invoke this skill in situations where direct reasoning, alternative tools, or narrower workflows would be more appropriate. In agent systems, broad routing rules increase the chance of unintended tool execution and expand the attack surface for prompt-injection or unsafe operational behavior tied to the skill.

Static analysis

No suspicious patterns detected.