Gumloop

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:23 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent Gumloop connector, but its setup path asks users to run unverified remote installer scripts and one interruptive Gumloop action is treated like a safe read.

Review the setup instructions before installing. Prefer installing the OOMOL CLI through a verified official package or by downloading and inspecting a versioned installer, and treat `kill_flow_run` and `start_flow_run` as actions requiring explicit confirmation because they can affect live Gumloop work.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installation Scripts Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 60–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute them using Bash or PowerShell. The Skill does not pin a script or CLI version, verify a cryptographic signature or checksum, save the script for inspection, or constrain what the downloaded code may do. Although the download domain is consistent with the named OOMOL service, this does not guarantee the integrity of future responses. The effective executable payload can change after the Skill has been reviewed. Compromise of the hosting service, its release pipeline, DNS infrastructure, or another relevant delivery component could turn these installation commands into an arbitrary-code-execution channel. This behavior exceeds the minimum privileges needed for the declared Gumloop connector operations. Normal operations are appropriately restricted to `Bash(oo *)`, but the installation instructions introduce execution of unaudited external code that may perform operations unrelated to Gumloop. ### Attack Path 1. The `oo` command is unavailable, causing the first-time setup path to be used. 2. The Agent or user runs one of the documented installation commands. 3. The remote endpoint, or a compromised component in its software delivery process, returns attacker-controlled shell or PowerShell code. 4. The pipe into `bash` or `iex` executes the response immediately without integrity validation or review. 5. The payload performs arbitrary actions with the privileges of the invoking process. 6. Depending on those privileges, the payload may read accessible credentials and f ...[truncated 834 chars]
• Remediation: ## Remediation Suggestions 1. Remove both direct pipe-to-interpreter installation commands. 2. Distribute the CLI through a trusted, authenticated package repository or a versioned official release. 3. Pin an explicit CLI version rather than downloading a mutable installation script. 4. Download the installer or binary to disk without executing it automatically. 5. Verify a vendor-issued cryptographic signature or a hard-coded SHA-256 checksum obtained through an independent trusted channel. 6. Abort installation if verification fails; do not permit a silent fallback to unverified execution. 7. Allow the downloaded artifact to be inspected before execution and document its expected files, permissions, and system changes. 8. Run installation with the least-privileged account possible and avoid requesting administrative privileges unless a documented installation step strictly requires them. 9. Prefer platform package managers with signature verification, while pinning both the package identity and version. 10. Keep normal Skill execution restricted to the existing `oo` command family and require installation to be an explicit user-controlled prerequisite rather than an Agent-executed fallback.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell (`curl ... | bash`), which executes network-fetched code without prior verification. In a skill context, this is especially risky because the agent may surface or encourage execution of the command during error handling, exposing users to supply-chain compromise, MITM, or malicious changes to the installer endpoint.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This manifest description defines invocation scope in very broad terms and does not provide exclusions or narrower trigger conditions. Because it says to use the skill for any Gumloop-related task, it risks unintended invocation whenever Gumloop is mentioned, rather than only for specific supported actions or contexts.

Static analysis

No suspicious patterns detected.