Fixer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent read-only Fixer connector, but its setup guidance includes executing an unverified remote installer script.

Review the setup step before installing. The connector behavior itself is read-only Fixer data access through OOMOL, but users should avoid running the remote installer blindly and should prefer an official package, downloaded installer review, or checksum/signature verification where available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57

Finding

Unverified Remote Installation Scripts Executed Directly by Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions retrieve mutable scripts from external URLs and immediately execute them with Bash or PowerShell. There is no version pinning, checksum verification, digital-signature validation, local inspection step, or other mechanism that establishes the downloaded payload's integrity before execution.

The download host is consistent with the declared OOMOL service, and installing the required CLI is relevant when oo is unavailable. However, immediate execution of unverified network content exceeds the minimum privilege and trust necessary to document or install that dependency. The effective payload can change after this Skill has been reviewed.

The Skill itself does not contain evidence that the scripts are malicious. Nevertheless, compromise of the hosting infrastructure, publishing process, domain, or delivery path could turn these commands into an arbitrary-code-execution channel.

Attack Path

1. The oo command is unavailable, causing the Agent or user to follow the first-time setup instructions.
2. An attacker compromises the remote installation script, its hosting or publishing infrastructure, or another component of the delivery chain.
3. curl or irm downloads the attacker-controlled script.
4. The pipeline passes the response directly to bash or iex without integrity verification or review.
5. The malicious script executes with the privileges of the Agent or user who launched the command.

Impact Assessment

A compromised installation payload could execute arbitrary commands with the invoking accou ...[truncated 913 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all direct curl | bash and irm | iex installation instructions.
2. Prefer a trusted operating-system package manager or a version-pinned release artifact from the CLI's documented official distribution channel.
3. Download the installer or binary to a local file without executing it automatically.
4. Pin the expected release version and verify a publisher-provided cryptographic signature or SHA-256 checksum before execution.
5. Display the exact artifact, source, version, and command to the user, and require explicit approval before installing software.
6. Run installation with ordinary user privileges unless elevated privileges are demonstrably required. Do not request blanket administrator or root access.
7. Document how users can inspect the downloaded installer and abort safely if verification fails.
8. Where practical, distribute the required CLI through a reproducible and auditable packaging process rather than a mutable remote script.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends installing software via 'curl ... | bash', which executes a remotely fetched script without prior verification. If the install endpoint, transport, DNS, or hosting account is compromised, an agent or user following this guidance could run attacker-controlled code on the local system.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use this skill for "ANY Fixer request" whenever a task involves Fixer, which is a very broad activation condition for a markdown skill file. It does not provide boundaries, exclusions, or negative examples to clarify when the skill should not be invoked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.