Fomo

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:10 AM UTC
• Version: 1.0.3

Overview

This Fomo skill is purpose-aligned, but its first-time setup tells users or agents to execute remote installer scripts directly, which deserves review before installation.

Before installing, prefer a verified oo CLI installation method such as a signed or checksummed release or trusted package manager. If you use this skill, review and approve any first-time setup manually, and require explicit confirmation before creating, updating, or deleting Fomo events.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md:59` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction streams a mutable remote script directly into Bash. Although HTTPS provides transport encryption and server authentication, it does not guarantee that the script is safe, immutable, or identical to the version reviewed during this audit. The instruction does not pin a release, verify a cryptographic signature or checksum, save the script for inspection, or constrain its execution privileges. Consequently, compromise of the remote host, publishing account, DNS infrastructure, or installation pipeline could cause arbitrary attacker-controlled commands to execute under the invoking user's account. Installing the CLI supports the Skill's declared functionality, but direct remote-to-shell execution exceeds the minimum mechanism necessary. A separately downloaded and cryptographically verified package would accomplish the same goal with lower risk. ### Attack Path 1. The `oo` command is unavailable, causing the user or agent to follow the first-time setup instructions. 2. An attacker compromises or gains control over `https://cli.oomol.com/install.sh` or its delivery infrastructure. 3. The documented command downloads the attacker's current script without validating a pinned digest or signature. 4. Bash immediately interprets the downloaded content. 5. The payload executes with all privileges available to the invoking user and may download additional payloads, steal accessible credentials, alter files, or establish persistence. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installer. The accessible scope may include the user's files, environment variabl ...[truncated 336 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Distribute the CLI through a trusted package manager or a version-pinned release artifact. - Download the installer or binary to disk as a separate step rather than executing streamed content. - Publish a SHA-256 digest and, preferably, a cryptographic signature through an independently protected channel. - Verify the digest or signature before execution. - Permit review of the downloaded installer and document its expected filesystem and network effects. - Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. - Pin documentation to a known version so the effective installer cannot change silently after Skill review.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md:63` **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: Critical ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction uses `Invoke-RestMethod` (`irm`) to retrieve a mutable remote PowerShell script and sends the response directly to `Invoke-Expression` (`iex`). This causes unreviewed network content to be interpreted as PowerShell code immediately. No fixed release, content hash, Authenticode signature validation, or manual review boundary is present. HTTPS alone does not protect against compromise of the legitimate server or release process, nor does it ensure that future content remains equivalent to the audited content. CLI installation may be necessary for first-time setup, but evaluating remotely retrieved text with `iex` is not necessary for the declared Fomo connector functionality and creates an avoidable arbitrary-code execution channel. ### Attack Path 1. The `oo` command is unavailable on a Windows system. 2. The user or agent follows the documented PowerShell setup instruction. 3. An attacker has modified `install.ps1` or compromised the server, publishing account, or delivery infrastructure. 4. `irm` retrieves the attacker's script without checking a pinned hash or trusted signing certificate. 5. `iex` evaluates the response immediately in the current PowerShell process. 6. The payload acts with the invoking user's privileges and can access local data, modify the user's environment, retrieve further payloads, or attempt persistence and privilege escalation. ### Impact Assessment Successful exploitation enables arbitrary PowerShell command execution under the invoking user's security context. This can expose files, environment variables, browser or CLI credentials accessible to that user, and connected service data reachable ...[truncated 268 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Provide a version-pinned MSI, signed PowerShell module, package-manager package, or release binary from a verifiable official source. - Download the artifact separately and never pass a network response directly to `Invoke-Expression`. - Require Authenticode signature validation against an expected publisher certificate, or verify a securely published SHA-256 digest before execution. - Document the expected publisher, version, hash, installation paths, and required permissions. - Execute installation without administrator privileges unless a narrowly defined installation step requires them. - Preserve an inspection and confirmation boundary between downloading and executing the installer.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`). This pattern is dangerous because it executes network-fetched code without prior verification, allowing compromise if the distribution server, DNS/TLS path, or install script is tampered with; in this skill context, the script installs a CLI that will later be used with authenticated connector access, increasing the blast radius of a successful supply-chain attack.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: Line L03 says to use this skill for "ANY Fomo request," covering all reading, creating, updating, and deleting tasks involving Fomo. This activation guidance is broad and lacks exclusion conditions or narrower trigger constraints, increasing the chance of unintended invocation whenever Fomo is merely mentioned.

Static analysis

No suspicious patterns detected.