Security audit

Google Routes

Security checks for vulnerabilities and agentic risk

Overview

This skill is for Google Routes through OOMOL, but it includes an unsafe remote installer command and broadly routes potentially sensitive location requests through a third party.

Before installing, review the oo CLI installation method and prefer a verified package or signed release instead of piping a remote script into a shell. Use this skill only when you are comfortable sending route origins, destinations, waypoints, and related metadata through OOMOL's connector service.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:53
Finding: Unverified Remote Installation Scripts Executed Directly
Content: View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download scripts from an external OOMOL-controlled URL and immediately execute them using Bash or PowerShell. The commands provide no version pinning, cryptographic signature validation, checksum verification, or opportunity to inspect the downloaded content before execution. Although HTTPS provides transport protection, it does not establish that future content at these URLs will match the code reviewed during this audit. A compromise of the hosting infrastructure, publishing credentials, DNS resolution, TLS termination environment, or upstream build system could cause arbitrary attacker-controlled code to be delivered. Because the effective payload remains remotely mutable after the Skill has been reviewed, this behavior matches `T03: Remote Payload Retrieval and Execution`. ### Attack Path 1. An attacker compromises the installer hosting service, deployment pipeline, publishing credentials, or another component controlling `cli.oomol.com`. 2. The attacker replaces `install.sh` or `install.ps1` with a malicious payload. 3. The `oo` command is unavailable, causing the user or agent to follow the documented first-time setup process. 4. The shell downloads the current remote script. 5. The pipe passes the response directly to Bash or PowerShell without local validatio ...[truncated 928 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: Mandatory Third-Party Routing of Potentially Sensitive Location Data
Content: View full analysis
" --data '' --json ``` ```markdown - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. - The response is `{ "data": ..., "meta": { "executionId": "..." } }`; the execution id lives under `meta.executionId`. ``` ### Technical Analysis The Skill directs the agent to use the OOMOL connector for every Google Routes request and explicitly instructs it not to call the Google API directly. The resulting JSON payload is submitted through the `oo` CLI to OOMOL’s connector infrastructure. Google Routes requests commonly contain origins, destinations, intermediate waypoints, and route preferences. Such information may reveal home or workplace locations, planned travel, recurring movements, or other sensitive location-related information. The documentation acknowledges that OOMOL processes the request and injects credentials server-side, so the transfer is not covert. However, the unconditional instruction to route every applicable request through this third party removes safer tool-selection options and may exceed the minimum access required to perform a direct Google Routes query. The broad instruction affects the agent’s behavior whenever the Skill is loaded and is therefore ca ...[truncated 1555 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote-code-execution risk because any compromise of the hosting site, network path, or script content results in immediate execution on the user's system without review or integrity verification.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Line L03 says to use this skill for "ANY Google Routes request" and "Whenever a task involves Google Routes," which is a very broad activation condition. It does not provide clearer scope boundaries or exclusion examples, so it could cause unintended invocation for loosely related mentions of Google Routes.
Content: No source excerpt is available for this finding.