Hookdeck

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:23 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for managing Hookdeck through OOMOL, but its first-time setup tells users to execute unverified remote installer scripts directly in a shell.

Review the first-time setup carefully before installing. Prefer installing the oo CLI through a verified, versioned, checksum- or signature-checked method instead of running the inline curl or PowerShell commands directly. For normal Hookdeck use, confirm all write and delete payloads before allowing the skill to run them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:69
• Finding: Unverified Remote Installation Scripts Executed Directly by Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 69–73 **Vulnerability Type**: Remote payload retrieval and execution without integrity verification **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download scripts from `cli.oomol.com` and immediately execute the returned content using Bash or PowerShell. The commands do not pin a release, verify a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded script before execution. Consequently, the effective code executed by these commands is mutable and is not part of the audited Skill package. Compromise of the remote server, its deployment pipeline, DNS resolution, or another trusted delivery component could cause arbitrary attacker-controlled code to be returned and executed. Installing the CLI is relevant to first-time setup, but piping mutable network content directly into a shell is not necessary for the Skill's declared Hookdeck functionality and exceeds a safe minimum installation procedure. ### Attack Path 1. The `oo` command is unavailable, causing the user or agent to follow the first-time setup instructions. 2. The remote installation endpoint or a component in its delivery chain is compromised or serves an altered script. 3. The `curl` or `Invoke-RestMethod` command downloads the modified content. 4. The shell executes the content immediately through `bash` or `Invoke-Expression`. 5. The payload performs arbitrary actions under the privileges of the invoking process, before the legitimate CLI workflow begins. This path requires the installation command to be executed. The audited file does not itself prove compromise of the referenced domain. ### Impact Assessment A malicious installation response can execute arbitrary commands ...[truncated 658 chars]
• Remediation: ## Remediation Suggestions 1. Replace pipe-to-shell and `Invoke-Expression` installation commands with a documented, version-pinned installation process. 2. Download the installer to a local file without executing it immediately. 3. Publish and verify a cryptographic checksum for the exact installer version. 4. Prefer signature verification using a trusted, separately distributed signing key. 5. Display the installer source or installation plan and require explicit user approval before execution. 6. Prefer an established operating-system package manager with signed metadata and pinned package versions. 7. Execute installation with standard user privileges unless a specific operation demonstrably requires elevation. 8. If an installer script remains necessary, use a pattern such as: ```bash curl -fSL -o oo-install.sh "https://trusted.example/oo/releases/VERSION/install.sh" echo "EXPECTED_SHA256 oo-install.sh" | sha256sum --check less oo-install.sh bash oo-install.sh ``` 9. For PowerShell, download to a file, validate an Authenticode signature or published hash, and invoke the verified file without `Invoke-Expression`.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs fetching and executing a remote installation script via `curl ... | bash`, which is a classic supply-chain risk. If the remote host, script, transport trust chain, or distribution endpoint is compromised, arbitrary code would execute on the user's machine with the user's privileges.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Hookdeck request" and "Whenever a task involves Hookdeck," which is a very broad activation condition. It does not provide constraints or negative examples, so ordinary mentions of Hookdeck could trigger the skill even when the user did not intend to operate on Hookdeck data.

Static analysis

No suspicious patterns detected.