Security audit

Featurebase

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing Featurebase, but its first-time setup tells agents to run unverified remote install scripts, which needs review before installation.

Install only if you are comfortable with OOMOL's oo CLI and Featurebase access. Review or install the CLI through a safer official method before using the skill, and confirm all create, update, and delete operations carefully.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:65
Finding: Unverified Remote Installation Scripts Executed Directly by Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 65–69 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download scripts from `cli.oomol.com` and execute them immediately through Bash or PowerShell. Neither command pins an immutable release, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded content before execution. Although the domain is consistent with the declared OOMOL service, the project provides no evidence that the remote resources are immutable or independently integrity-verified. Consequently, the effective code executed by the Skill can change after this static review. Compromise of the hosting server, deployment pipeline, DNS or TLS trust chain, or vendor account could turn these installation commands into an arbitrary-code-execution channel. Installing the `oo` CLI may be relevant to the Skill's declared functionality, but executing an unverified remote payload is not the minimum privilege or safest mechanism required to perform that installation. ### Attack Path 1. The `oo` command is unavailable, causing the documented first-time setup path to apply. 2. A user or agent follows the installation instruction in `SKILL.md`. 3. `curl` or PowerShell's `Invoke-RestMethod` retrieves a mutable script from `cli.oomol.com`. 4. The pipe to `bash` or `iex` executes the response without integrity validation or review. 5. If the remote script or its delivery infrastructure has been compromised, attacker-controlled commands execute with the permissions of the invoking user. 6. Those commands can access resources available to that user and may make further system changes. ### Impact As ...[truncated 797 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all direct `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation instructions. 2. Direct users to a trusted operating-system package manager or an official, signed release artifact. 3. Pin the installation to a specific CLI version rather than a mutable generic installation endpoint. 4. Download the installer or binary without executing it automatically. 5. Publish and verify a cryptographic checksum or digital signature before installation. 6. Fail closed when signature or checksum validation fails. 7. Display the artifact source, version, expected digest, and intended changes before requesting explicit user approval. 8. Avoid elevated privileges unless a documented installation step strictly requires them. 9. Keep installation separate from ordinary connector operations; do not trigger installation automatically after a failed command. 10. If scripts must be used, vendor a reviewed version or reference an immutable, signed release and instruct users to inspect it before execution. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 96% confidence
Finding: The skill instructs the agent to install software via `curl ... | bash`, which executes remote code directly from the network without verification. In an adversarial or compromised delivery scenario, this can lead to arbitrary code execution on the host, and the risk is amplified because the skill is explicitly telling the agent to run the command as part of fallback setup.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The instruction to use this skill for 'ANY Featurebase request' and 'Whenever a task involves Featurebase' creates an overly broad trigger condition that can cause the agent to invoke the skill in loosely related contexts without adequate narrowing. In an agentic system, broad auto-selection language increases the chance of unintended data access or state-changing operations being routed through this integration when a more constrained or user-confirmed path would be safer.

Intent-Code Divergence

Low

Confidence: 96% confidence
Finding: Line L45 documents `get_post` as `Get one Featurebase post by ID. [write]`, which contradicts the surrounding documentation pattern where `get_*` actions are reads and only `[write]` tags indicate state changes. The Safety section at L54-L56 reinforces that reads are untagged and writes change state, so this is an active documentation contradiction rather than a mere omission.

Static analysis

No suspicious patterns detected.