Griptape

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:23 AM UTC
• Version: 1.0.2

Overview

This Griptape connector skill is mostly coherent, but its setup instructions include unverified remote installer commands and it can perform account-changing actions.

Review the install path before using this skill. Prefer installing the oo CLI through a verified package or inspected installer, avoid running remote shell pipelines directly, and confirm every write or delete action against the exact Griptape resource and payload.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 66–70 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute them using Bash or PowerShell. No immutable version, cryptographic checksum, digital signature, or publisher verification is required before execution. The piped execution also prevents meaningful inspection of the downloaded content before it runs. Because the effective payload resides outside the reviewed project, it can change after this Skill has passed review. HTTPS provides transport protection but does not establish that future script contents are safe. Compromise of the hosting service, publishing account, DNS infrastructure, or upstream release process could therefore turn the documented installation command into an arbitrary-code execution channel. This behavior is not necessary for the Skill's declared connector functionality. Installation can instead be performed using a versioned, integrity-verified package after explicit user approval. ### Attack Path 1. The `oo` CLI is absent, causing a command to fail with `oo: command not found`. 2. The Agent follows the first-time setup instructions in `SKILL.md`. 3. Bash or PowerShell retrieves a mutable installation script from `cli.oomol.com`. 4. The response body is passed directly to the relevant shell without integrity or publisher verification. 5. If the remote endpoint or publishing chain has been compromised, attacker-controlled commands execute with the privileges of the user running the Agent. 6. Those commands can access data available to that user, modify the local envi ...[truncated 701 chars]
• Remediation: ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` execution patterns. 2. Direct users to an official, versioned release whose artifact is immutable. 3. Pin the installation instructions to a specific reviewed CLI version rather than a mutable installation endpoint. 4. Publish and require verification of a SHA-256 or stronger checksum. Prefer a digitally signed release with documented publisher-key verification. 5. Download the installer to a local file first, verify its integrity and signature, and permit inspection before execution. 6. Require explicit user approval immediately before running any installer. 7. Run the installer with ordinary user privileges unless a narrowly defined operation demonstrably requires elevation. 8. Prefer a trusted package manager that supports version pinning and package-signature validation. 9. Apply equivalent controls to both the Bash and PowerShell installation paths. 10. Document the expected files, network destinations, and system changes made by installation so users can assess the requested privileges.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software via a remote shell pipeline (`curl ... | bash`), which executes network-fetched code without verification. In an adversarial or compromised distribution scenario, this could lead to arbitrary code execution on the host running the skill, and the context makes it more dangerous because the skill is allowed to use Bash and may handle authenticated connector workflows.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger text says to use this skill for ANY Griptape request, including reading, creating, updating, and deleting data. That broad routing can cause the agent to invoke a high-privilege integration too eagerly, increasing the chance of unintended data access or state-changing operations when a narrower or direct workflow would be safer.

Static analysis

No suspicious patterns detected.