FullContact

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:47 AM UTC
• Version: 1.0.3

Overview

This FullContact skill is mostly purpose-aligned, but its first-time setup tells users to execute remote installer scripts directly without verification.

Review the installer path carefully before installing. Prefer installing the oo CLI through a verified, pinned, or signed distribution method instead of piping remote scripts directly into a shell, and only submit personal identifiers when you have consent and a valid reason to process them through both OOMOL and FullContact.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Remote Shell Script Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:55-60` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ``` ### Technical Analysis The installation command pipes content obtained from a mutable external URL directly into Bash. The downloaded script is neither pinned to a reviewed version nor validated using a cryptographic signature or checksum before execution. TLS protects the network connection to the currently resolved server, but it does not establish that the returned script is immutable or safe. Compromise of the hosting server, CDN, DNS infrastructure, deployment pipeline, or publisher account could change the effective payload after this Skill has been reviewed. Although installation is only presented as a fallback when `oo` is unavailable, executing an unrestricted installer is substantially more privileged than the routine `oo connector` commands required by the declared FullContact functionality. ### Attack Path 1. The `oo` command is unavailable on the user's system. 2. The Agent or user follows the first-time setup instructions. 3. An attacker compromises the installer host, its deployment pipeline, or another component controlling the response from `https://cli.oomol.com/install.sh`. 4. The endpoint returns a modified shell script. 5. `curl` sends the response directly to Bash without an inspection or verification step. 6. The attacker's commands execute with all permissions available to the invoking shell. ### Impact Assessment A malicious installer could execute arbitrary commands under the invoking account. Depending on that account's privileges and environment, it could: - Read or modify user-accessible files. - Access credentials, tokens, SSH material, ...[truncated 437 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Prefer an official operating-system package manager or a pinned release artifact from a documented publisher. - Download the installer as a separate file without executing it: ```bash curl -fL -o install.sh https://example.invalid/pinned/install.sh ``` - Publish and verify a cryptographic checksum or signature obtained through a separately trusted channel. - Pin the installer to an immutable version rather than a mutable generic `install.sh` endpoint. - Allow the user to inspect the downloaded file before execution. - Require explicit user approval before running installation commands. - Run the installer with the least-privileged account possible and document any files, permissions, or services it will modify. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Remote PowerShell Payload Evaluated Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:62-64` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The command uses `Invoke-RestMethod` (`irm`) to obtain PowerShell source code from a mutable external endpoint and immediately passes the response to `Invoke-Expression` (`iex`). This creates a direct remote-code-execution channel with no version pinning, Authenticode validation, checksum verification, or opportunity to inspect the script. The payload can change independently of the audited Skill. HTTPS alone does not protect against a compromised publisher, hosting platform, deployment pipeline, or signing account. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. The user or Agent follows the documented PowerShell setup command. 3. An attacker gains control over the installer endpoint or its delivery pipeline. 4. The endpoint returns attacker-controlled PowerShell source. 5. `irm` retrieves the source and passes it directly to `iex`. 6. PowerShell evaluates the response with the invoking process's permissions. ### Impact Assessment Successful exploitation permits arbitrary PowerShell execution in the user's security context. A malicious payload could: - Access files and credentials available to the current user. - Modify the registry, PowerShell profile, or user startup configuration. - Download and execute additional payloads. - Exfiltrate local data and connector-related information. - Establish persistence where the current account has sufficient rights. - Make system-wide changes if invoked from an elevated PowerShell session. Because the remote script is absent from the project, its actual installation behavior and privilege requirements were not auditable. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not pipe a network response into `Invoke-Expression`. - Download a version-pinned installer to disk before execution. - Verify a publisher-provided cryptographic checksum through a separately trusted channel. - Require a valid Authenticode signature from the expected publisher and reject unsigned or invalidly signed files. - Display the target version and requested system changes and obtain explicit user approval before execution. - Prefer a signed MSI, Microsoft Store package, WinGet package, or another managed distribution mechanism. - Avoid elevation unless it is demonstrably required, and document all requested privileges. ]]>

other

Warning

• Location: SKILL.md:27
• Finding: Personal Identifiers Are Sent Through an Additional Third-Party Connector<; OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```markdown **2. Run the action** with a JSON payload that matches the input schema: ```bash oo connector run "full_contact" --action "<action_name>" --data '<json>' --json ``` ``` ```markdown - `enrich_company` — Enrich a company profile with FullContact by domain. - `enrich_person` — Enrich a person profile with FullContact by sending one or more known identifiers. - `verify_activity` — Return FullContact activity scores for matched person identifiers. - `verify_match` — Compare person identifiers with FullContact and return field-level match flags. - `verify_signals` — Resolve person identifiers with FullContact and return identity signal details. ``` ### Technical Analysis The documented actions submit company domains and person identifiers through OOMOL's connector infrastructure for processing by FullContact. This transmission is relevant to the declared enrichment and verification functionality and is disclosed in the Skill; the audited file does not demonstrate covert exfiltration or direct exposure of raw API tokens. Nevertheless, the design introduces OOMOL as an additional data-processing and credential trust boundary. The Skill does not provide instructions concerning data minimization, user consent, permitted identifier types, retention, redaction, or handling of regulated personal information. Its instruction to use the Skill for any FullContact request may also cause data to be routed through this intermediary when a direct integration could otherwise reduce exposu ...[truncated 1531 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Clearly disclose that submitted identifiers are processed by both OOMOL and FullContact before the first data-bearing request. - Obtain explicit user approval before sending personal or sensitive identifiers. - Retrieve the connector schema and submit only the minimum fields necessary for the requested operation. - Avoid sending free-form context, unrelated records, secrets, or sensitive attributes unless strictly required and authorized. - Document applicable privacy policies, retention periods, deletion procedures, subprocessors, and data-processing terms. - Add guidance for regulated or highly sensitive identifiers and prohibit their submission unless the integration expressly supports compliant handling. - Protect the OOMOL account with strong authentication and least-privilege connector scopes. - Where practical, offer a direct FullContact integration so users can avoid the additional intermediary. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`), which enables arbitrary code execution if the remote server, transport, or distribution path is compromised. Because this appears in a troubleshooting/setup path inside the skill, an agent or user following the instructions could execute unreviewed code on the host environment.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This manifest/markdown description defines activation in very broad terms that can overlap with many ordinary tasks mentioning FullContact, including tangential references. It does not provide narrowing criteria, examples, or negative cases to clarify when the skill should or should not be invoked.

Static analysis

No suspicious patterns detected.