Envoy

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:38 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for Envoy account access, but its first-time setup tells users to execute unverified remote installer scripts, which is a high-impact installation risk.

Install only if you are comfortable with OOMOL's oo CLI and Envoy connector model. Avoid running the documented curl|bash or irm|iex installer directly; prefer a verified, pinned installer or official package path, and confirm any action tagged as write before it runs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Execution via curl and bash## Vulnerability Details **File Location**: `SKILL.md:62` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command pipes a remotely retrieved shell script directly into `bash`. The remote content is executed before the user or agent can inspect it, and the instructions do not pin a release version or verify a cryptographic signature or checksum. Although the URL uses HTTPS and its domain is consistent with the declared OOMOL service, the effective payload remains mutable after the Skill has been reviewed. Compromise of the hosting account, publishing pipeline, server, or trusted delivery path could therefore turn this documented setup step into an arbitrary code-execution channel. Installing the required CLI is relevant to the Skill's functionality, and the instructions limit installation to the `oo: command not found` case. However, executing unverified remote code is broader than the minimum privilege needed to install a specific, reviewed CLI release. ### Attack Path 1. The `oo` CLI is unavailable, causing an action to fail with `oo: command not found`. 2. The agent or user follows the first-time setup instructions. 3. `curl` downloads the current content of `https://cli.oomol.com/install.sh`. 4. The response body is streamed directly into `bash` without integrity or authenticity verification beyond HTTPS. 5. If the remote payload or its publishing infrastructure has been compromised, attacker-controlled shell commands execute with the privileges of the invoking account. 6. Those commands could access, modify, or transmit resources available to that account. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of the user running the installation command. This can expose local files, envi ...[truncated 484 chars]
• Remediation: ## Remediation Suggestions - Do not pipe downloaded content directly into a shell. - Distribute versioned CLI artifacts through an official, authenticated release channel. - Pin the installation instructions to a specific reviewed version rather than a mutable installer endpoint. - Download the installer or package to a local file first, then verify a publisher signature or a SHA-256 checksum obtained through an independently authenticated channel. - Display the verified file path and require explicit user approval before execution. - Prefer an operating-system package manager with package-signature verification where available. - Run installation with ordinary user privileges and request elevation only for a narrowly defined operation when strictly necessary. - Document the destination files, permissions, network endpoints, and expected changes so users can assess the installer before execution. A safer workflow is: ```bash curl -fSLo oo-install.sh "https://trusted.example/releases/<pinned-version>/install.sh" echo "<trusted-sha256> oo-install.sh" | sha256sum -c - # Review the file and obtain explicit user approval before running: bash oo-install.sh ```

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Execution via Invoke-RestMethod and Invoke-Expression## Vulnerability Details **File Location**: `SKILL.md:66` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` is an alias for `Invoke-RestMethod`, while `iex` is an alias for `Invoke-Expression`. This pipeline retrieves text from a remote URL and immediately evaluates it as PowerShell code. The instructions provide no version pinning, Authenticode validation, checksum verification, or opportunity to inspect the downloaded script before execution. HTTPS protects against some network interception threats but does not protect against compromise of the legitimate server, publishing credentials, or release pipeline. Because the endpoint can change independently of the audited Skill, the command allows future remote content to determine what code executes. Installing the CLI supports the Skill's declared purpose, and this fallback is only documented for a missing command. Nevertheless, immediate evaluation of a mutable script exceeds the least-privilege and minimum-trust approach necessary to install a known CLI version. ### Attack Path 1. An Envoy action cannot run because the `oo` CLI is not installed. 2. The agent or user follows the Windows first-time setup command. 3. `Invoke-RestMethod` retrieves the current `install.ps1` response. 4. The pipeline passes the response directly to `Invoke-Expression`. 5. If the hosted script or its publishing infrastructure is compromised, attacker-supplied PowerShell executes in the current process context. 6. The payload can act on files, credentials, configuration, and network resources available to the invoking Windows account. ### Impact Assessment Exploitation provides arbitrary PowerShell execution under the invoking user's security context. Potential scope includes reading user-accessible files and envi ...[truncated 426 chars]
• Remediation: ## Remediation Suggestions - Replace the `irm ... | iex` pattern with a download-verify-review-execute workflow. - Pin the installer to a specific CLI release. - Sign the PowerShell installer with a trusted Authenticode certificate and require a valid signature before execution. - Publish and verify a cryptographic checksum through an independently authenticated release channel. - Require explicit user approval after verification and before starting the installer. - Avoid administrative execution unless a documented installation step strictly requires it. - Prefer a signed package distributed through a trusted Windows package repository. A safer workflow is: ```powershell Invoke-WebRequest ` -Uri "https://trusted.example/releases/<pinned-version>/install.ps1" ` -OutFile ".\install.ps1" if ((Get-FileHash ".\install.ps1" -Algorithm SHA256).Hash -ne "<TRUSTED_SHA256>") { throw "Installer integrity verification failed." } if ((Get-AuthenticodeSignature ".\install.ps1").Status -ne "Valid") { throw "Installer signature validation failed." } # Review the script and obtain explicit user approval before running it. & ".\install.ps1" ```

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 96% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which executes a remote script directly without verification. If the distribution endpoint, DNS, TLS termination, or hosting environment is compromised, arbitrary code could run on the user's machine with the user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The instruction 'Whenever a task involves Envoy, use this skill' is ambiguous about what level of involvement qualifies, encouraging invocation even when Envoy is only mentioned indirectly. In an agent setting, this ambiguity can cause premature or unnecessary execution of external actions instead of responding locally or asking clarifying questions.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The instruction 'Whenever a task involves Envoy, use this skill' is ambiguous about what level of involvement qualifies, encouraging invocation even when Envoy is only mentioned indirectly. In an agent setting, this ambiguity can cause premature or unnecessary execution of external actions instead of responding locally or asking clarifying questions.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill labels `get_invite` as a fetch/read operation but also marks it `[write]`, which contradicts the documented safety model that untagged `get/list` actions are safe reads. This can cause an agent or operator to misclassify the action’s risk, either over-trusting write semantics elsewhere or incorrectly handling a supposedly read-only action without proper confirmation.

Static analysis

No suspicious patterns detected.