Icypeas

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:28 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for using Icypeas through OOMOL, but it asks for broader CLI authority than its documented actions need and includes direct execution of remote installer scripts.

Review this before installing. Prefer installing the oo CLI through a verified or package-manager-based method if available, and be aware that this skill's current tool permission could let an agent run oo commands beyond the listed Icypeas connector actions. Confirm any write payload carefully because Icypeas searches and verification requests may consume credits or change account state.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Installation Scripts Are Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 60–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and execute them immediately through Bash or PowerShell. The commands do not pin a script version, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution. Consequently, the code ultimately executed is not contained in the audited project and may change after the Skill has been reviewed. Although installing the required CLI is related to the declared functionality, direct `curl | bash` and `irm | iex` execution is not the minimum-risk installation mechanism. This creates a supply-chain execution channel. Compromise of the hosting service, publication process, DNS/TLS trust chain, or installation script could turn the documented setup process into arbitrary code execution. ### Attack Path 1. The `oo` command is unavailable, causing the user or agent to follow the first-time setup instructions. 2. An attacker compromises the installation-script host or its deployment pipeline, or otherwise causes malicious script content to be served. 3. `curl` or `Invoke-RestMethod` retrieves the attacker-controlled content. 4. The shell pipe passes the content directly to Bash or `Invoke-Expression`. 5. The payload executes without integrity verification or prior inspection. 6. The payload can act with all privileges available to the user running the installation command. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking account. This may allow access to user ...[truncated 326 chars]
• Remediation: ## Remediation Suggestions 1. Replace direct piped execution with a version-pinned package-manager installation or a fixed release artifact from an authenticated official release repository. 2. Download the artifact to a local file before execution rather than piping network output directly into a shell. 3. Publish and verify a SHA-256 or stronger digest through a separately protected channel. 4. Prefer cryptographic release signatures and verify them against a pinned, documented publisher key. 5. Display the resolved version and source to the user and require explicit approval before installation. 6. Run installation without administrative privileges unless a specific installation step demonstrably requires elevation. 7. If scripts remain necessary, pin immutable versioned URLs and document a reviewable manual installation process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4
• Finding: Overly Broad Permission for All oo CLI Subcommands## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Excessive tool authorization **Risk Level**: Medium **Complete Code Snippet**: ```yaml allowed-tools: [Bash(oo *)] ``` ### Technical Analysis The Skill authorizes every command beginning with `oo`, while its routine declared functionality only requires schema inspection and connector execution for the `icypeas` connector: ```bash oo connector schema "icypeas" --action "<action_name>" oo connector run "icypeas" --action "<action_name>" --data '<json>' --json ``` The wildcard therefore grants a broader command surface than is necessary for normal Icypeas operations. Other `oo` subcommands could affect authentication, configuration, connections, or unrelated services, depending on the installed CLI version and the invoking user's permissions. This does not independently prove that an unauthorized command is executed by the current Skill instructions. It is nevertheless a least-privilege violation that increases the impact of instruction confusion, malicious payloads, future documentation changes, or vulnerabilities in command construction. ### Attack Path 1. The Skill is loaded with permission to execute any `oo` subcommand. 2. An attacker influences a requested payload or execution instructions, or a future Skill revision introduces an unintended `oo` command. 3. The broad `Bash(oo *)` rule allows that command to run without being limited to Icypeas schema inspection or action execution. 4. The command operates using the invoking user's existing OOMOL session and available account permissions. 5. Any resulting access or state changes extend beyond the connector operations required by the Skill. ### Impact Assessment The exposed scope includes all functionality reachable through the installed `oo` CLI under the current user's credentials, rather than only the two required connector command forms. The exact ...[truncated 273 chars]
• Remediation: ## Remediation Suggestions 1. Replace `Bash(oo *)` with narrowly scoped permissions for the required `oo connector schema` and `oo connector run` command forms. 2. Restrict connector operations to the literal `icypeas` service where the permission model supports argument-level constraints. 3. Explicitly deny authentication, configuration, installation, and unrelated connector commands during ordinary Skill execution. 4. Validate action names against the six documented Icypeas actions before invoking the CLI. 5. Continue requiring explicit user confirmation for write actions and ensure confirmation covers the exact validated payload. 6. If the permission framework cannot express safe argument-level restrictions, use a small audited wrapper that exposes only schema retrieval and Icypeas action execution.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 96% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which executes a remote script directly without prior verification, integrity checking, or review. If the hosting domain, transport path, or upstream release process is compromised, this becomes an immediate remote code execution vector on the user's machine.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description uses an extremely broad activation condition: any task that "involves Icypeas" should use this skill. For a markdown/manifest file, this lacks clear scope boundaries or exclusion conditions and could overlap with many routine mentions of Icypeas rather than specific intended actions.

Static analysis

No suspicious patterns detected.