Gemini

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.3

Overview

The skill is mostly purpose-aligned for using Gemini through OOMOL, but its setup tells users to run unverified internet-downloaded installer scripts.

Review the installer path before installing. Prefer a signed or package-manager installation of the oo CLI, or download and verify the installer before running it. Also be aware that Gemini generation actions may use connected-account credits even though the skill frames untagged actions as safe to run directly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:62` **Vulnerability Type**: Remote payload retrieval and execution through a pipe-to-shell installation command **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable script from an external URL and pipes the response directly into Bash. The script is executed without first saving and reviewing it, pinning it to a specific release, or verifying a cryptographic checksum or digital signature. Consequently, the code that ultimately executes is not contained in the audited Skill and can change after the audit. Compromise of the remote server, DNS or delivery infrastructure, or the vendor's publication process could cause arbitrary attacker-controlled shell commands to run. Installing the CLI may be necessary for the Skill's declared Gemini connector functionality, but immediate execution of an unverified remote response exceeds the minimum privilege and trust necessary to perform installation safely. ### Attack Path 1. The `oo` command is unavailable on a macOS or Linux system. 2. The Agent or user follows the documented first-time setup instruction. 3. `curl` retrieves the current content served by `https://cli.oomol.com/install.sh`. 4. The response is passed directly to Bash without inspection or integrity verification. 5. If the response has been maliciously altered, Bash executes attacker-controlled commands with the privileges of the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the installation command. An attacker could access files and environment variables available to that account, steal accessible credentials, alter user-owned configuration or executables, transmit local information, install persistence within user-writable locations, or destroy user-accessible data. ...[truncated 265 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the direct `curl | bash` execution pattern. - Distribute a version-pinned installer or package through a trusted package manager. - If a script must be downloaded, save it to disk before execution and require explicit user approval. - Publish a checksum through an independently protected channel and verify it before running the installer. - Prefer cryptographically signed release artifacts and validate the signature against a pinned, documented signing key. - Document the exact version being installed and avoid mutable installation URLs. - Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. - Example hardened workflow: ```bash curl -fSLo oo-install.sh "https://trusted.example/releases/<pinned-version>/install.sh" echo "<expected-sha256> oo-install.sh" | sha256sum -c - less oo-install.sh bash oo-install.sh ``` The placeholder URL, version, and checksum must be replaced with authenticated values published by the vendor. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Download and Evaluation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:66` **Vulnerability Type**: Remote payload retrieval and execution through PowerShell `Invoke-Expression` **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction uses `Invoke-RestMethod` (`irm`) to retrieve mutable PowerShell content and immediately sends it to `Invoke-Expression` (`iex`). `Invoke-Expression` evaluates the response as executable PowerShell code. There is no version pinning, local review, checksum verification, Authenticode signature validation, or other mechanism binding the downloaded payload to the version reviewed with this Skill. The external response therefore remains an unaudited code-execution channel. Although installing the required CLI supports the declared connector functionality, direct evaluation of an unverified network response is not necessary and grants the delivery endpoint more trust than the task requires. ### Attack Path 1. The `oo` command is unavailable on a Windows system. 2. The Agent or user follows the documented first-time setup instruction. 3. `Invoke-RestMethod` downloads the current content from `https://cli.oomol.com/install.ps1`. 4. The pipeline passes the response directly to `Invoke-Expression`. 5. If the endpoint or its delivery chain has been compromised, attacker-controlled PowerShell commands execute in the invoking user's session. ### Impact Assessment Successful exploitation allows arbitrary PowerShell execution with the invoking user's privileges. This may expose user-readable files, environment variables, browser or application data accessible to the account, and credentials available in the process context. An attacker could also modify user configuration, download additional payloads, establish user-level persistence, or delete accessible data. The audited instruction does not explicitly request administrator rig ...[truncated 199 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `irm | iex` pattern. - Download a version-pinned installer to a local file rather than evaluating the network response. - Validate an Authenticode signature from an explicitly trusted publisher before execution. - Alternatively, verify a cryptographic checksum obtained through an independently authenticated channel. - Require explicit user approval after showing the artifact's source, version, verification result, and requested privileges. - Prefer a signed MSI or trusted package-manager distribution over a mutable PowerShell bootstrap script. - Avoid administrator execution unless a documented installation step strictly requires it. - A safer workflow should follow this pattern: ```powershell Invoke-WebRequest ` -Uri "https://trusted.example/releases/<pinned-version>/install.ps1" ` -OutFile ".\oo-install.ps1" Get-AuthenticodeSignature ".\oo-install.ps1" Get-FileHash ".\oo-install.ps1" -Algorithm SHA256 Get-Content ".\oo-install.ps1" & ".\oo-install.ps1" ``` Execution must occur only after validating the expected signer or authenticated checksum and obtaining user approval. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`), which executes network-fetched code without prior verification. If the install endpoint, transport, DNS, or hosting is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text instructs use of this skill for "ANY Gemini request," which is overly broad and can cause the agent to invoke the skill in situations where a narrower or safer path would be more appropriate. In an agent ecosystem, broad invocation guidance increases the attack surface for unintended tool use and makes policy scoping and user-intent matching less reliable.

Static analysis

No suspicious patterns detected.