Formspree

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:38 AM UTC
• Version: 1.0.2

Overview

This Formspree skill is mostly coherent, but it needs Review because its setup path tells users to run unverified remote installer scripts and its broad trigger can access potentially sensitive form submissions through an additional service.

Review before installing. Use this only if you are comfortable with Formspree submission data passing through OOMOL's connector infrastructure, and avoid running the one-line remote installer commands unless you independently trust and verify the oo CLI installer. Prefer a versioned, checksum- or signature-verified installation path and ask for confirmation before retrieving sensitive submissions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both installation commands retrieve mutable executable content from `cli.oomol.com` and immediately pass it to a command interpreter. The downloaded scripts are not pinned to an immutable release, saved for inspection, checked against a cryptographic hash, or verified with a publisher signature. HTTPS protects the connection in transit, but it does not eliminate risks from compromise of the hosting server, publishing account, DNS infrastructure, or release pipeline. Because the retrieved content can change after this Skill has been reviewed, the commands constitute a remote payload execution channel. Installing a CLI may be relevant to the declared Formspree functionality, but executing an unreviewed remote script is not the minimum privilege or safest installation mechanism required to provide that functionality. ### Attack Path 1. The `oo` command is unavailable, causing the first-time setup instructions to apply. 2. The user or Agent runs the documented Bash or PowerShell installation command. 3. The remote host, its publishing infrastructure, or an associated account serves modified script content. 4. The pipeline sends that content directly to Bash or PowerShell without an intermediate verification step. 5. The script executes arbitrary commands with all permissions available to the invoking account. 6. The payload can access local data, alter user configuration, install additional software, or establish persistence, subject to the invoking account's permissions and any elevation subsequently requested by the installer. ### Impact Assessment Successful exploitation pr ...[truncated 553 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation instructions. 2. Direct users to a documented, trusted package manager or an immutable release artifact. 3. Pin the CLI to a specific version rather than retrieving the latest mutable installer. 4. Download the installer or package without executing it automatically. 5. Publish and require verification of a cryptographic signature or a SHA-256 checksum obtained through a separately protected channel. 6. Allow the user to inspect the downloaded artifact before execution. 7. Run installation with ordinary user privileges wherever possible, and clearly document any operation that requires elevation. 8. Prefer instructions resembling the following safe sequence: - Download a versioned artifact. - Verify its publisher signature and expected digest. - Inspect or unpack it in a controlled location. - Execute it only after verification succeeds. ]]>

other

Warning

• Location: SKILL.md:27
• Finding: Formspree Submission Data Is Routed Through an Additional Third-Party Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–31 **Vulnerability Type**: Third-party data disclosure **Risk Level**: Medium ### Vulnerable Code ```bash oo connector run "formspree" --action "<action_name>" --data '<json>' --json ``` - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. - The response is `{ "data": ..., "meta": { "executionId": "..." } }`; the execution id lives under `meta.executionId`. ``` ### Technical Analysis The Skill requires Formspree operations to be performed through the OOMOL `oo` connector rather than directly against Formspree. According to the Skill description, OOMOL injects Formspree credentials server-side. Consequently, request parameters and returned Formspree data are processed by infrastructure operated by an additional service provider. Form submissions can contain names, email addresses, message contents, and other personal or confidential information. This transmission is disclosed and is functionally necessary for the connector architecture selected by the Skill; there is no evidence of covert exfiltration. Nevertheless, it expands the trust boundary beyond Formspree and the local user. The Skill does not explain OOMOL's logging, retention, data-residency, access-control, or deletion practices. It also broadly directs the Agent to use this connector for any Formspree request, without requiring confirmation before potentially sensitive submission data is retrieved. ### Attack Path 1. A user asks the Agent to list or search Formspree submissions. 2. The Agent constructs a JSON request and invokes `oo connector run`. 3. The request and associated metadata are transmitted to OOMOL's connector infrastructure. 4. OOMOL uses server-side credentials to access the connected Formspree account. 5. Formspree submission data is returned through OOMOL's infrastructure to the local caller. 6. If the intermediary service, its logs, or an authorized operator is comprom ...[truncated 713 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Clearly disclose that request data and Formspree submissions are processed by OOMOL infrastructure. 2. Document applicable retention, logging, encryption, data-residency, access-control, and deletion policies. 3. Request explicit user approval before retrieving submissions likely to contain personal or confidential information. 4. Apply data minimization by retrieving only the records and fields necessary for the user's task. 5. Avoid placing unnecessary secrets or unrelated sensitive information in connector payloads. 6. Provide a direct Formspree API option when organizational policy prohibits processing through an additional intermediary. 7. Ensure connector responses and execution logs are not persisted longer than operationally necessary. 8. Recommend that users verify the authorization scopes granted to the Formspree connection and restrict them to read-only access required by `list_submissions`. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill includes a one-line installer that fetches a remote script and pipes it directly to bash, which executes unverified code from the network. If the remote host, transport, distribution path, or install script is compromised, users may execute arbitrary code on their machine with the privileges of the current shell.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger text is excessively broad: it instructs use of this skill for ANY Formspree request and whenever a task involves Formspree, which can cause the agent to invoke the skill on mere mentions rather than clear user intent. That increases the chance of unintended external data access or connector execution, especially because the skill is framed as the default path instead of requiring a narrower, task-specific trigger.

Static analysis

No suspicious patterns detected.