FireHydrant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent FireHydrant connector, but its setup instructions include unsafe remote installer execution and its routing language is broader than users may expect.

Review this skill before installing. It can read FireHydrant data and create incidents through OOMOL, so incident and service details may pass through that connector. Do not run the documented curl-to-bash or Invoke-Expression installer blindly; prefer a verified package, pinned release, checksum, or official manual install path, and confirm exact payloads before any write action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61

Finding

Unverified Remote Installation Scripts Are Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–65
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable content from an external server and immediately pass it to a command interpreter. The downloaded content is not pinned to a specific release, saved for review, checked against a cryptographic hash, or verified using a digital signature.

HTTPS protects the content while it is in transit, but it does not establish that the script remains identical to the version reviewed during this audit. Compromise of the hosting service, publishing account, DNS infrastructure, or deployment pipeline could cause arbitrary commands to be returned and executed.

The same vulnerability exists on both supported platforms:

• On macOS and Linux, curl output is piped directly into bash.
• On Windows, Invoke-RestMethod output is passed directly to Invoke-Expression.

The instructions are presented as a fallback when the oo command is unavailable. Although they are not intended to run on every invocation, executing them is not necessary for the Skill's core FireHydrant operation when the CLI is already installed. Moreover, the installation commands fall outside the declared Bash(oo *) tool restriction.

Attack Path

1. The Agent attempts to invoke oo and receives a command-not-found error.
2. The Agent follows the documented first-time setup procedure.
3. The Agent requests install.sh or install.ps1 from the external OOMOL endpoint.
4. An attacker who has compromised the endpoint, account, DNS path, or release pipeline returns a modified installation script.
5. The shell executes the r ...[truncated 919 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all pipe-to-shell and download-to-Invoke-Expression installation instructions.
2. Prefer a trusted platform package manager with a version-pinned package.
3. If release artifacts must be downloaded directly:
   • Pin an explicit CLI version.
   • Download the artifact to a local file rather than executing the response stream.
   • Publish its expected SHA-256 or stronger digest through a separately protected channel.
   • Verify a vendor digital signature before execution.
   • Abort installation if integrity or signature verification fails.
4. Display the resolved version, source URL, expected publisher, and requested installation location before execution.
5. Require explicit user approval before installing software.
6. Perform installation with the lowest available privileges and avoid requesting administrator or root access unless strictly required.
7. Keep installation outside normal Skill execution and document manual, auditable setup steps.
8. Align setup behavior with the declared tool allowlist rather than documenting commands outside Bash(oo *).

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Universal FireHydrant Routing Instruction Forces Data Through a Third-Party Connector

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 3
Vulnerability Type: Skill instruction hijacking and forced third-party routing
Risk Level: High

Vulnerable Code

yaml

description: "FireHydrant (firehydrant.com). Use this skill for ANY FireHydrant request — reading, creating, and updating data. Whenever a task involves FireHydrant, use this skill instead of calling the API directly."

Technical Analysis

The Skill's description directs the Agent to capture every FireHydrant-related request and explicitly prohibits direct API use. The operational instructions then route request payloads and responses through the OOMOL oo connector service.

Third-party network communication is functionally related to the declared connector architecture and is disclosed in the documentation. However, the universal instruction exceeds neutral invocation guidance because it removes the Agent's ability to honor a user preference for direct FireHydrant access or to select a lower-exposure integration path.

FireHydrant records can contain operational incident, service, and environment information. Routing all such content through an additional service provider expands the trust boundary beyond FireHydrant. The reviewed Skill states that OOMOL injects credentials server-side, so it does not directly instruct the Agent to handle raw FireHydrant tokens; nevertheless, action parameters and returned operational data necessarily transit the intermediary connector.

Attack Path

1. A user submits a request involving FireHydrant.
2. The broad Skill description causes the Agent to select this Skill for any such request.
3. The Agent is instructed not to use FireHydrant's API directly.
4. The Agent invokes oo connector schema and oo connector run.
5. FireHydrant action parameters and resulting data are processed through OOMOL's connector infrastructure.
6. Sensitive operational information is consequently exposed ...[truncated 1023 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the universal routing instruction with conditional, capability-based language.
2. Remove the directive that the Agent must use this Skill instead of the direct API in every case.
3. Clearly disclose before first use that request parameters and response data are processed through OOMOL.
4. Obtain user consent before transmitting sensitive incident or infrastructure information through the intermediary.
5. Permit direct FireHydrant API access when explicitly requested or when it provides a lower-exposure path.
6. Document the categories of information transmitted, processing purpose, retention policy, access controls, and deletion procedure.
7. Minimize request payloads to fields required by the selected action.
8. Preserve the existing requirement to confirm exact payloads and effects before write operations.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote-code-execution risk: if the install endpoint, transport, or hosting account is compromised, arbitrary commands would run on the local system without prior verification.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use this skill for "ANY FireHydrant request" and "Whenever a task involves FireHydrant," which is very broad and lacks boundaries or negative examples. In a manifest/markdown context, this can cause unintended invocation for casual mentions or tasks that only reference FireHydrant indirectly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.