Resource Flow (Hub Planner)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:00 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Hub Planner connector, but its setup instructions tell users or agents to run mutable remote installer scripts directly in a shell.

Review this skill before installing. The Hub Planner connector behavior is disclosed and mostly scoped, but avoid running the installer pipeline as written unless you trust the OOMOL installer endpoint and account context. Prefer official, versioned installation instructions with checksum or signature verification, and confirm any create_project or create_resource payload before allowing write actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installer Executed Through a Shell Pipeline## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote mutable payload retrieval and immediate execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a shell script from an external URL and pipes it directly into `bash`. The downloaded content is not pinned to a reviewed version and is not authenticated through a cryptographic signature or checksum. It is also not saved for inspection before execution. Consequently, the effective code executed by this instruction can change after the Skill has been audited. Installing the `oo` CLI supports the declared connector functionality, but immediate remote-to-shell execution exceeds the minimum mechanism necessary to perform that installation. A versioned, independently verified package or artifact would provide the same functionality with less supply-chain risk. The audit did not establish that the current installer is malicious. The vulnerability is that compromise of the remote host, installer publication process, or delivery infrastructure could convert this documented setup command into arbitrary local code execution. ### Attack Path 1. An attacker compromises `cli.oomol.com`, the installer publishing process, or another component capable of modifying the response from `https://cli.oomol.com/install.sh`. 2. The attacker replaces or modifies the installer with malicious shell commands. 3. The `oo` command is unavailable, causing the user or Agent to follow the documented first-time setup instruction. 4. `curl` retrieves the attacker-controlled response. 5. The pipe passes the response directly to `bash` without integrity verification or prior inspection. 6. The malicious commands execute with the privileges of the account running the installation command. ### Impact Assessment Success ...[truncated 554 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation command from the Skill. - Direct users to official, reviewable installation documentation instead of causing downloaded content to flow directly into a shell. - Prefer a trusted platform package manager or a version-pinned release artifact. - Publish an expected cryptographic checksum or signature through an independently protected channel and verify it before execution. - Separate retrieval from execution so the installer can be inspected: ```bash curl -fSL -o install.sh https://example.invalid/path/to/versioned/install.sh # Verify the documented signature or checksum here. less install.sh bash install.sh ``` - Pin the artifact to an immutable version or digest rather than a mutable `install.sh` endpoint. - Keep installation explicitly user-controlled and avoid having the Agent run installers automatically after an operational failure.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote PowerShell Installer Executed In Memory## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Remote mutable payload retrieval and immediate execution **Risk Level**: High **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction uses `Invoke-RestMethod` (`irm`) to retrieve a PowerShell script from an external URL and passes the response directly to `Invoke-Expression` (`iex`). This executes remotely supplied text in the current PowerShell context without pinning the installer version, validating a cryptographic signature or checksum, or allowing review of the downloaded script. The remote endpoint can provide different code after the Skill has been reviewed. Although installing the `oo` CLI is related to the declared connector functionality, in-memory execution through `iex` is not the least-risk installation method. The audit did not establish that the current remote script contains malicious code; the confirmed issue is the unrestricted delivery and execution channel. ### Attack Path 1. An attacker gains the ability to alter the script served by `https://cli.oomol.com/install.ps1`, such as through compromise of the host or installer release process. 2. The attacker inserts malicious PowerShell commands into the response. 3. A Windows user follows the first-time setup instruction because the `oo` CLI is missing. 4. `Invoke-RestMethod` retrieves the modified script. 5. `Invoke-Expression` immediately evaluates the response as PowerShell code without integrity validation. 6. The attacker's commands execute with the privileges and accessible environment of the invoking PowerShell process. ### Impact Assessment Exploitation allows arbitrary PowerShell execution under the invoking user's privileges. The payload could access user-readable files, authentication material, environment data, and other resources available to that ...[truncated 291 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` instruction. - Provide a version-pinned installer or signed package obtained from an official release channel. - Download the artifact to disk, validate its Authenticode signature or a separately published cryptographic checksum, and only then execute it. - Allow the user to inspect the script before execution. - Prefer a package manager that supports package identity, version pinning, and integrity verification. - Use an immutable release URL or digest instead of a mutable installer endpoint. - Do not automatically invoke installation as part of normal connector operation; require an explicit, informed user action.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 95% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This is dangerous because it executes unverified code from the network with the user's privileges, and if the distribution endpoint, TLS trust, or upstream content is compromised, it enables arbitrary code execution on the host.

Static analysis

No suspicious patterns detected.