Instantly.ai

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 1.0.3

Overview

The skill is a coherent Instantly.ai connector, but its setup instructions tell users to execute remote installer scripts directly without verification.

Review this before installing. The Instantly.ai connector behavior is mostly clear, but avoid running the provided curl|bash or irm|iex installer commands unless you independently trust and verify the OOMOL CLI installer. Prefer a verified package, pinned release, checksum, or manual install guide, and confirm exact payloads before creating or changing Instantly.ai data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58

Finding

Unverified Remote Installer Download and Immediate Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands retrieve mutable content from an external server and pass it directly to a command interpreter. The downloaded content is not saved for inspection and is not verified using a pinned cryptographic hash or a validated release signature.

HTTPS protects the connection in transit but does not establish that the retrieved script is the same version that was reviewed. If the hosting service, publishing account, DNS resolution, certificate infrastructure, or delivery pipeline is compromised, the effective installer can be changed after this Skill has been audited.

This behavior is not necessary for ordinary connector operations. The document states that the CLI should already be installed and that setup is only a fallback after a command failure. Moreover, the declared tool permission is Bash(oo *), while installation requires invoking curl and a shell outside that narrow operational interface. Executing a general-purpose installer therefore exceeds the minimum privileges required to call the Instantly.ai connector.

The finding applies to both the Unix shell pipeline and the equivalent PowerShell download-and-execute pipeline.

Attack Path

1. An attacker compromises or gains control over cli.oomol.com, its deployment pipeline, its DNS path, or another component capable of altering the installer response.
2. The attacker replaces install.sh or install.ps1 with a malicious payload.
3. The oo command is unavailable, causing the Skill to enter its documented first-time setup flow.
4. The agent or user executes the provid ...[truncated 1280 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove direct curl | bash and irm | iex instructions.
2. Direct users to a versioned, human-readable installation guide or a trusted operating-system package manager.
3. Pin the CLI to a specific release rather than retrieving a mutable installer endpoint.
4. Download the release artifact to disk before execution and verify a publisher-provided SHA-256 digest or cryptographic signature whose trust root is distributed separately.
5. Display the artifact path, expected version, checksum, publisher, and intended changes, then require explicit user approval before running it.
6. Keep installation outside the Skill's automated execution path. If oo is absent, report the condition and ask the user to install it independently.
7. Do not request administrator privileges unless a documented installation step strictly requires them. Prefer a user-local installation directory.
8. Preserve the narrow Bash(oo *) permission boundary and ensure the Skill cannot invoke downloaders, general-purpose shells, PowerShell expression evaluation, or unapproved executables.
9. If an installer script remains necessary, publish immutable versioned scripts, sign releases, document their expected behavior, and avoid piping network responses directly into interpreters.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install the CLI by piping a remotely fetched script directly into a shell (curl ... | bash). This pattern is dangerous because it executes unauthenticated or insufficiently verified remote code immediately; if the distribution server, network path, or script content is compromised, arbitrary code execution occurs on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description uses a very broad activation phrase ('Use this skill for ANY Instantly.ai request'), which can cause the agent to invoke this skill for a wide range of tasks without sufficient narrowing or user-intent verification. In practice, this increases the chance of over-triggering a connector that can perform writes, which can lead to unintended data access or state changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.