HERE

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:38 AM UTC
• Version: 1.0.3

Overview

This HERE connector skill is mostly coherent, but its setup instructions ask users to execute unverified remote installer scripts with shell-level authority.

Review the installer path before using this skill. Prefer installing the oo CLI through a verified, pinned package or by downloading and inspecting the installer first; avoid piping remote scripts directly into a shell, especially from an elevated terminal. The HERE actions themselves appear read-oriented and purpose-aligned once the CLI and account connection are already set up.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Script Execution via Bash## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable shell script from an external server and pipes it directly into Bash. The payload is executed without version pinning, checksum validation, cryptographic signature verification, local inspection, or any other integrity control. HTTPS protects the connection in transit but does not guarantee that the hosted script is immutable or safe. Compromise of the hosting infrastructure, publishing account, delivery path, or the script itself would allow the effective payload to change after the Skill has been reviewed. The external script is not included in the project and therefore cannot be evaluated by this audit. Installing the required CLI supports the Skill's declared functionality, but granting a remote endpoint the ability to supply arbitrary shell commands at execution time exceeds the minimum privilege necessary to install a known CLI artifact. ### Attack Path 1. The user or agent attempts to use the Skill on macOS or Linux without the `oo` CLI installed. 2. The command fails with `oo: command not found`. 3. The Skill directs the user or agent to execute the documented `curl | bash` command. 4. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 5. Bash immediately interprets the response under the privileges of the invoking user. 6. If the remote script or its delivery infrastructure has been compromised, attacker-controlled commands execute without an integrity check or review step. ### Impact Assessment The downloaded script receives arbitrary code-execution capability with the invoking user's privileges. It could read or modify user-accessible files ...[truncated 427 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation instruction. - Distribute a version-pinned CLI artifact through an audited operating-system package manager or another trusted installation mechanism. - Pin installation instructions to a specific immutable release rather than a mutable generic installation URL. - Publish a SHA-256 checksum and a cryptographic signature for each release. - Download the artifact separately, verify both its checksum and signature, and only then execute or install it. - Document the files, permissions, and network access required by the installer. - Do not request elevated privileges automatically; require explicit user review when privileged installation is genuinely necessary. - Provide instructions that let users inspect the downloaded installer before execution.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote Script Execution via PowerShell## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: Critical **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The PowerShell installation instruction retrieves a mutable remote script with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). No fixed version, checksum, signature, or local inspection step constrains the code that the remote endpoint can provide. `Invoke-Expression` interprets the downloaded response as PowerShell code in the current process. Consequently, the reviewed Skill does not define the effective installation behavior; the content served by the external endpoint at execution time does. HTTPS alone does not protect against compromise of the script publisher, hosting infrastructure, or future replacement of the hosted payload. Although installing the CLI is related to the declared HERE connector functionality, immediate evaluation of arbitrary remotely supplied PowerShell code grants broader capability than is necessary to install a known, verified release. ### Attack Path 1. The user or agent attempts to use the Skill on Windows without the `oo` CLI installed. 2. The command fails because `oo` is unavailable. 3. The Skill directs the user or agent to run the documented PowerShell command. 4. `irm` downloads the current contents of `https://cli.oomol.com/install.ps1`. 5. The pipeline passes the response directly to `iex`. 6. PowerShell executes the response with the invoking user's privileges. 7. A compromised or replaced remote installer can therefore execute attacker-controlled commands without verification or prior inspection. ### Impact Assessment A malicious response can execute arbitrary PowerShell operations available to the invoking account. Potenti ...[truncated 476 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Publish a version-pinned MSI, MSIX, or other signed Windows installation package. - Require validation of the package's Authenticode signature and expected publisher before installation. - Publish and verify a SHA-256 checksum through an independently protected release channel. - Download installers to disk for verification and inspection instead of evaluating network responses directly. - Prefer a trusted package manager with immutable version selection and package-signature enforcement. - Document required permissions and avoid automatic administrator elevation. - Ensure installation failure does not cause the agent to execute alternative unverified commands automatically.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs use of a remote installer via `curl ... | bash`, which executes code fetched over the network without prior verification, pinning, or integrity checks. If the install endpoint, transport path, or hosting account is compromised, the agent or user could execute attacker-controlled shell code, leading to full environment compromise.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger text says to use this skill for "ANY HERE request" and whenever a task involves HERE, which is broader than necessary and can cause the agent to route many loosely related requests into this skill automatically. Broad routing increases the chance the agent will invoke shell-backed tooling in contexts where a direct answer or narrower integration would be safer, especially because the skill also contains setup instructions that can lead to command execution.

Static analysis

No suspicious patterns detected.