Financial Modeling Prep

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.4

Overview

This skill mostly matches its financial-data purpose, but its setup instructions include unverified remote installer commands that can execute arbitrary code.

Review the installer path before using this skill. Prefer installing the oo CLI through a pinned, verifiable official release or package manager, and do not let an agent automatically run the curl-to-bash or irm-to-iex setup commands without explicit approval and independent verification.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:91

Finding

Unverified Remote Installer Execution Through Shell Pipelines

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:91-95
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The setup instructions pipe remotely retrieved content directly into command interpreters. The Unix command sends the response from curl to bash, while the Windows command passes the response from Invoke-RestMethod (irm) to Invoke-Expression (iex).

Neither instruction pins an immutable installer version nor verifies a cryptographic signature or checksum before execution. Consequently, the code ultimately executed can change after the Skill has been reviewed. Although installation is presented as a fallback for a missing oo CLI, executing a mutable remote installer is not the minimum privilege necessary to retrieve financial data through the declared connector.

No malicious installer content is embedded in the reviewed project, and the trustworthiness of the remote scripts cannot be established from SKILL.md. The vulnerability is the unauthenticated-at-the-artifact-level remote execution channel rather than confirmed malicious behavior by the current installer.

Attack Path

1. The oo command is unavailable, causing the first-time setup instructions to be used.
2. An agent or user runs the documented installation command.
3. The command retrieves a mutable script from cli.oomol.com.
4. An attacker who compromises the hosting account, deployment pipeline, domain, or another relevant delivery component substitutes malicious script content.
5. The shell executes the substituted content immediately without checksum, signature, or manual-content verification.
6. The payload performs arbitrary actions under the privileges of the us ...[truncated 822 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove direct curl | bash and irm | iex installation patterns.
2. Distribute the CLI through a trusted package manager or an authenticated official release repository.
3. Pin installation instructions to a specific immutable release rather than a mutable installer endpoint.
4. Download the installer or package to a local file before execution so it can be inspected.
5. Publish a cryptographic checksum and a verifiable digital signature through an independent trusted channel.
6. Verify both the checksum and signature before invoking any interpreter or installer.
7. Require explicit user approval before installing software; an agent should not automatically execute setup commands after a tool failure.
8. Document the files, network destinations, and permissions required by the installer, and avoid administrator privileges unless a specific operation requires them.
9. Prefer instructions similar to the following controlled sequence:

bash

curl --fail --show-error --location \
  --output oo-installer.sh \
  "https://trusted.example/releases/vX.Y.Z/oo-installer.sh"

echo "<published-sha256>  oo-installer.sh" | sha256sum --check -
# Verify the publisher's digital signature as well.
less oo-installer.sh
bash oo-installer.sh

The actual release URL, checksum, and signature must come from an authenticated official source and must be pinned to the intended release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill instructs users to install software by piping a remote script directly into a shell, which enables arbitrary code execution if the remote server, CDN, or delivery path is compromised. Because this appears in a setup path for a tool that the agent may suggest during troubleshooting, it materially increases supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for "ANY Financial Modeling Prep request" and "Whenever a task involves Financial Modeling Prep," which is a very broad activation condition. It does not define boundaries, exclusions, or negative examples, so ordinary requests that merely mention the service could trigger the skill unnecessarily.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.