Granola

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:00 AM UTC
• Version: 1.0.2

Overview

This Granola skill is mostly coherent, but its setup instructions tell the agent to run unverified remote installer scripts, which deserves review before use.

Review the setup path before installing. Prefer installing the oo CLI from a trusted, versioned, verifiable source instead of running the pasted pipe-to-shell commands, and only connect Granola if you are comfortable granting OOMOL-mediated access to your meeting notes and transcripts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installer Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 60–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute their contents through Bash or PowerShell. There is no version pinning, checksum validation, cryptographic signature verification, local inspection step, or trusted package-manager boundary. HTTPS protects the connection in transit but does not establish that the returned script is the same code that was reviewed. The effective payload can change after publication of the Skill. A compromise of the domain, hosting infrastructure, installer release pipeline, or signing account could therefore turn these setup commands into arbitrary code-execution mechanisms. This behavior is not required for the Skill's primary function of reading Granola data through an already-installed `oo` CLI. Installation should be separated from normal Skill operation and remain an explicit, independently verifiable user action. ### Attack Path 1. A Granola action fails because the `oo` CLI is not installed. 2. The Agent or user follows the documented first-time setup procedure. 3. `curl` or `Invoke-RestMethod` retrieves the current installer response from the remote server. 4. The response is passed directly to Bash or `Invoke-Expression` without verification or review. 5. If the remote source or delivery pipeline has been compromised, attacker-controlled commands execute with the privileges of the invoking process. 6. Those commands could access locally available data, alter files, install additional software, or establish persistence, subject to the invoking account's permissions. ### Im ...[truncated 673 chars]
• Remediation: ## Remediation Suggestions 1. Remove both direct download-to-shell pipelines from the Skill instructions. 2. Prefer an official operating-system package manager or another installation channel that verifies signed, versioned packages. 3. If standalone installers are necessary, pin an explicit release version and publish immutable artifact URLs. 4. Require users to download the installer as a file rather than executing the network response directly. 5. Publish SHA-256 checksums through a separately protected channel and verify the downloaded artifact before execution. 6. Prefer detached cryptographic signatures backed by a documented release key; verify both the signature and expected signer identity. 7. Ask the user for explicit approval before any installation and clearly describe the commands, destination, and required privileges. 8. Run installation without administrative privileges unless a specific, documented operation requires elevation. 9. Keep CLI installation outside routine Skill execution. The Skill should fail safely and direct the user to reviewed installation documentation when the CLI is unavailable.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`), which executes unreviewed code from the network immediately. If the install endpoint, transport chain, or upstream distribution is compromised, this becomes an easy path to arbitrary code execution on the user's system.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This markdown file is in scope for vague-trigger review. The phrase 'Use this skill for ANY Granola request' is broad and does not define boundaries, exclusions, or concrete trigger examples, making activation criteria ambiguous.

Static analysis

No suspicious patterns detected.