Front

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent Front connector, but its setup instructions include direct remote-script execution that users should review carefully before installing.

Review the oo CLI installation path before using this skill. Prefer a pinned, signed, or checksum-verified installer from the vendor, and confirm any create/update contact payloads before allowing the agent to run them against your Front workspace.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59

Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The first-time setup instructions execute mutable remote content directly in a local shell:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands retrieve scripts from an external server and immediately pass the responses to Bash or PowerShell. The instructions do not pin a version, verify a cryptographic signature or checksum, save the scripts for inspection, or confirm their contents before execution.

HTTPS provides transport protection but does not establish that the script remains identical to the version assessed during this audit. Compromise of the vendor server, publishing account, delivery infrastructure, or installer-generation process could change the effective payload after review.

Installing the oo CLI may be necessary when it is absent, and the document limits this instruction to first-time setup following a command failure. Nevertheless, direct network-to-shell execution exceeds the minimum safe mechanism needed to install the dependency.

Attack Path

1. The user or agent attempts to use the Skill and discovers that the oo command is unavailable.
2. The setup instructions direct it to execute the applicable Bash or PowerShell command.
3. The command retrieves a mutable installer from cli.oomol.com.
4. An attacker who has compromised the remote installer or its delivery infrastructure substitutes attacker-controlled script content.
5. Bash or PowerShell executes the response without integrity verification or review.
6. The substituted script performs arbitrary actions under the privileges of the invoking process.

Impact Assessment

A compromised installer could ...[truncated 881 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace network-to-shell pipelines with a version-pinned package or release artifact from an authenticated official distribution channel.
2. Publish cryptographic checksums and preferably signed release manifests. Verify both the signature and checksum before executing or installing the artifact.
3. Download the installer to a local file rather than piping it directly into a shell.
4. Display the artifact source, pinned version, expected digest, and intended filesystem or permission changes before installation.
5. Require explicit user approval before executing the downloaded installer.
6. Run installation with ordinary user privileges unless elevated privileges are strictly required for a documented operation.
7. Provide reproducible manual installation steps as a safer alternative.
8. If bootstrap scripts must remain available, pin them to an immutable release and document an independent verification procedure.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk: if the hosting endpoint, transport, or script content is compromised, arbitrary code will execute immediately on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill declares a very broad activation rule: 'Use this skill for ANY Front request.' That can cause the agent to invoke this skill in situations where a narrower or safer path would be more appropriate, increasing the chance of unintended reads or writes against the user's Front workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.