Google Maps

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:58 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Google Maps connector, but its setup instructions can run unverified remote installer scripts and route all Google Maps payloads through a third-party service.

Install only if you intentionally want Google Maps requests, including addresses, coordinates, and routes, to go through OOMOL. Do not let an agent run the installer one-liners automatically; use reviewed, version-pinned, or signed installation steps where possible, and approve account login or connection steps yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Execution During CLI Installation## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command pipes a script retrieved from an external server directly into Bash. The remote payload is not pinned to a specific version and is not validated using a cryptographic signature or a trusted checksum before execution. Although HTTPS protects the connection in transit, it does not ensure that the server, its deployment pipeline, DNS configuration, or future script contents remain trustworthy. The effective code executed by this Skill can therefore change after the Skill itself has been audited. This behavior is not necessary for the Google Maps connector's core functionality. Installation should be treated as a separate, explicitly authorized administrative operation rather than an automatic recovery action. ### Attack Path 1. The `oo` command is unavailable and an execution attempt fails. 2. The Agent follows the documented first-time setup procedure. 3. An attacker compromises `cli.oomol.com`, its deployment infrastructure, or another component capable of controlling the returned script. 4. `curl` retrieves the attacker-controlled response. 5. The shell pipe passes the response directly to Bash without inspection or integrity verification. 6. The attacker's commands execute locally with the privileges of the account running the Agent. ### Impact Assessment A malicious installation response can execute arbitrary commands with the current Agent user's privileges. This can expose files and environment variables available to that user, modify user-level configuration, install additional software, tamper with local tools, or establish persistence where existing permissions allow it. The reviewed file doe ...[truncated 190 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Pin installation instructions to a specific, immutable CLI release. - Download the installer or package without executing it immediately. - Publish a SHA-256 or stronger checksum through an independently protected channel and verify it before execution. - Prefer cryptographically signed packages from a trusted operating-system package manager. - Require explicit user approval before installing software or running any installer. - Clearly disclose the installer source, requested privileges, affected paths, and expected system changes. - If a script installer is unavoidable, save it locally and allow the user to inspect it before executing it.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Execution During CLI Installation## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `Invoke-RestMethod` retrieves mutable PowerShell content from an external URL and passes it directly to `Invoke-Expression`. No version pinning, signature validation, checksum verification, or manual inspection occurs before execution. Consequently, the code that runs is controlled by the response returned at installation time rather than by the reviewed Skill package. A compromise of the hosting service or release process would convert this setup command into an arbitrary PowerShell execution channel. Installing the CLI is not part of an ordinary Google Maps query and exceeds the minimum operations needed to perform the declared connector actions. It should require a distinct, informed user decision. ### Attack Path 1. The Skill is used on Windows and the `oo` CLI is not installed. 2. The Agent or user follows the documented PowerShell setup command. 3. An attacker gains control over the installation response through compromise of the host, deployment pipeline, or another trusted delivery component. 4. `Invoke-RestMethod` retrieves the malicious PowerShell payload. 5. `Invoke-Expression` executes the response immediately. 6. The payload performs arbitrary actions within the permissions of the PowerShell process. ### Impact Assessment Successful exploitation provides arbitrary command execution under the current Windows account. The payload could access user-readable data, retrieve additional malware, alter user configuration, replace local executables, or create persistence where the account's existing permissions permit it. No evidence in the reviewed file proves that the current remote installer is malicious. ...[truncated 100 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Distribute a version-pinned and Authenticode-signed installer or package. - Verify the publisher signature and expected certificate identity before installation. - Publish and verify a cryptographic checksum for the selected release. - Download the installer to disk without executing it automatically. - Require explicit user approval after disclosing the source, version, privileges, and expected changes. - Prefer a trusted Windows package manager with package-signature and integrity enforcement.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3
• Finding: Broad Redirection of Google Maps Requests Through a Third-Party Connector## Vulnerability Details **File Location**: `SKILL.md`, lines 3-28 **Vulnerability Type**: Skill instruction hijacking and sensitive-data routing **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml description: "Google Maps (mapsplatform.google.com). Use this skill for ANY Google Maps request — searching and reading data. Whenever a task involves Google Maps, use this skill instead of calling the API directly." ``` ```markdown Operate **Google Maps** through your OOMOL-connected account. This skill calls the `google_maps` connector with the [oo CLI](https://github.com/oomol-lab/oo-cli); OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```bash oo connector run "google_maps" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill directs the Agent to use the OOMOL intermediary for every Google Maps request and explicitly discourages direct API use. Connector payloads can include addresses, coordinates, search terms, origins, destinations, and other potentially sensitive location or travel information. Routing through OOMOL is necessary when the user deliberately chooses this connector, but the universal instruction exceeds the minimum scope needed to describe optional connector use. The document identifies OOMOL as the intermediary but does not provide a task-level privacy warning, data-minimization rules, or an instruction to obtain user consent before transmitting sensitive location data. The reviewed file states that credentials are injected server-side, and it does not contain raw tokens or demonstrate credential theft. The identified risk concerns disclosure of request payloads and metadata to an additional service. ### Attack Path 1. A user asks the Agent to search for a place, geocode an address, reverse-geocode coordinates, or calculate a route. 2. The broad Skill instruction causes the Agent to prefer OOMOL even if direct processing or another ...[truncated 965 chars]
• Remediation: ## Remediation Suggestions - Replace the universal “ANY Google Maps request” directive with narrowly scoped, user-selected connector behavior. - State clearly that request payloads are transmitted to OOMOL before invoking the connector. - Obtain explicit user approval before sending precise addresses, coordinates, route endpoints, or other sensitive location information. - Minimize payloads to fields strictly required by the selected connector action. - Avoid transmitting unrelated conversation content or unnecessary identifiers. - Document applicable data retention, logging, subprocessors, and deletion policies. - Allow users to decline third-party routing or select a direct API method where available. - Preserve the existing practice of not exposing raw credentials to the Skill, and ensure server-side credentials use only the scopes required for the requested read action.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into bash. This is dangerous because it executes unverified code from the network with the user's privileges, enabling supply-chain compromise, server-side content changes, MITM in weaker environments, or accidental execution in sensitive hosts.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The skill description mandates using this skill for ANY Google Maps request and instead of calling the API directly, which is an overly broad routing rule. Broad triggers increase the chance the agent invokes this skill in inappropriate contexts and inherits risky behaviors from the skill, including shell execution and setup guidance, when a narrower or safer path may exist.

Static analysis

No suspicious patterns detected.