football-data.org

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent football-data.org connector, but its setup instructions tell the agent to execute a remote installer script directly in the shell without verification or clear user approval.

Review before installing. The connector actions themselves are read-only and purpose-aligned, but do not let an agent run the installer fallback automatically; install the oo CLI only from a trusted, verified source and prefer a pinned or signed package with user approval.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60

Finding

Unverified Remote Installer Scripts Executed Directly by Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–64
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Complete vulnerable code snippet:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe network responses directly into Bash or PowerShell. Neither command pins a reviewed installer version nor verifies a cryptographic signature or checksum before execution. The effective code can therefore change after the Skill package has been reviewed.

HTTPS protects the connection in transit under ordinary conditions, but it does not protect against compromise of the remote publication infrastructure, unauthorized modification of the hosted installer, or malicious changes by an entity controlling the endpoint. The commands also provide no opportunity to inspect the downloaded content before executing it.

Installing the oo CLI is relevant when the required executable is unavailable, and the instructions place installation in a conditional fallback path. Nevertheless, immediate execution of an unverified remote response exceeds the minimum safe mechanism necessary to install the dependency.

Attack Path

1. A football-data.org action is requested while the oo executable is unavailable.
2. The attempted command fails with an oo: command not found error.
3. The first-time setup path is followed.
4. curl or Invoke-RestMethod retrieves the current installer from the remote OOMOL endpoint.
5. Bash or Invoke-Expression executes the response without integrity or authenticity verification.
6. If the endpoint, publishing account, or delivery infrastructure has been compromised, attacker-controlled commands execute with the privileges and environmental access of the invoking use ...[truncated 1004 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both pipe-to-shell installation commands.
2. Pin installation instructions to a specific, reviewed oo CLI release rather than a mutable installer URL.
3. Download the artifact to a local file without executing it immediately.
4. Publish a cryptographic signature or SHA-256 checksum through an independently protected channel and verify it before execution.
5. Prefer a trusted operating-system package manager or signed platform package where available.
6. Display the artifact source, pinned version, destination, and requested privileges before installation.
7. Require explicit user approval before downloading or executing an installer.
8. Run installation with ordinary user privileges unless elevated privileges are demonstrably necessary.
9. If an installer script remains necessary, present separate download, verification, inspection, and execution commands, and fail closed when verification is unsuccessful.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The skill instructs the agent to install software by piping a remote script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk because any compromise of the host, TLS interception, DNS hijack, or malicious script update would lead to arbitrary code execution on the machine running the skill. In this skill context, the danger is increased because the installation command is presented as an automated fallback path the agent may execute when oo is unavailable.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Static analysis

No suspicious patterns detected.