Heartbeat

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:10 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent Heartbeat read connector, but its setup instructions include unverified remote installer scripts that should be reviewed before use.

Review the `oo` CLI installation path before installing. Prefer an official package or a downloaded installer with a verified signature/checksum, and only connect Heartbeat after confirming the OOMOL account and connector scopes are appropriate for the community data you intend to read.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Shell Script Execution via curl and Bash## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command retrieves a mutable script from an external server and immediately passes its contents to Bash. It does not pin an immutable release, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded script before execution. Although HTTPS protects the connection in transit, it does not eliminate risks arising from compromise of the hosting service, publishing account, DNS infrastructure, or upstream installation script. Because the effective payload is maintained outside the audited project, it can also change after this Skill has been reviewed. Installing the CLI may be relevant during first-time setup, but unrestricted execution of an unverified remote script exceeds the minimum privileges required for the Skill's declared Heartbeat read operations. ### Attack Path 1. The `oo` CLI is unavailable, causing the first-time setup instructions to be used. 2. The command requests `https://cli.oomol.com/install.sh`. 3. The installation endpoint or associated infrastructure serves a compromised or malicious response. 4. The response is piped directly into Bash without integrity or authenticity verification. 5. The payload executes with all permissions available to the user or agent running the command. ### Impact Assessment A substituted installation script could execute arbitrary commands under the invoking user's account. Depending on that account's permissions, it could access local files and credentials, alter installed tools, download additional payloads, modify user configuration, or establish persistence. If the command is run with elevated privileges, the impact could extend to system-wide compromise. The ...[truncated 234 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation workflow. - Prefer a signed package distributed through a trusted package manager. - Pin the CLI to a specific immutable version instead of retrieving a mutable installation endpoint. - If a direct download is necessary, download the file without executing it, verify a publisher signature or a checksum obtained through an independent trusted channel, and only then execute the verified file. - Display the intended version, source, destination, and expected system changes before installation. - Require explicit user approval before installing software. - Run installation with the least-privileged account possible and avoid requesting administrative privileges unless a documented installation step strictly requires them.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote PowerShell Script Execution via Invoke-Expression## Vulnerability Details **File Location**: `SKILL.md`, line 65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` downloads content from an externally controlled URL, while `iex` interprets the returned text as PowerShell code immediately. The command performs no version pinning, signature verification, checksum validation, or local inspection before execution. The effective code is not present in the audited project and may change independently after review. HTTPS alone cannot establish that every future payload published by the endpoint is safe, particularly if the hosting service, publisher account, DNS, or release process is compromised. This execution channel grants substantially broader capabilities than are required to invoke the Skill's declared read-only Heartbeat connector actions. ### Attack Path 1. A Windows environment does not have the `oo` CLI installed. 2. The user or agent follows the documented first-time setup command. 3. `Invoke-RestMethod` retrieves the current response from `https://cli.oomol.com/install.ps1`. 4. A compromised endpoint or publishing process supplies attacker-controlled PowerShell. 5. `Invoke-Expression` executes the response immediately with the current PowerShell process's privileges. ### Impact Assessment A malicious response could run arbitrary PowerShell commands, read accessible files and credentials, change user or system settings, install additional software, tamper with local tools, or create persistence. The precise scope depends on the privileges of the PowerShell process; execution from an elevated terminal could result in system-wide compromise. No embedded malicious PowerShell payload was found in the audited project. The risk results from granting a mutable, unverified remote response direct access to a co ...[truncated 15 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Distribute the CLI through a signed and reputable Windows package mechanism where possible. - Pin downloads to a specific immutable release and verify the publisher's Authenticode signature or a securely published cryptographic checksum. - Save the installer to disk first, validate it, and execute it as a separate step rather than evaluating a network response in memory. - Require explicit user approval and disclose the source, version, installation destination, and expected changes. - Use a non-administrative PowerShell session unless elevated privileges are strictly necessary and separately approved.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill recommends installing software via `curl ... | bash`, which executes a remotely fetched script without prior integrity verification or review. If the install endpoint, transport path, or hosting account is compromised, an agent or user following this guidance could run attacker-controlled code on the local system.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use the skill for "ANY Heartbeat request," which is a very broad activation condition and does not define boundaries or exclusions. This can cause unintended invocation for casual mentions of Heartbeat or tasks where another workflow might be more appropriate.

Static analysis

No suspicious patterns detected.