Intuiface

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:45 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches its Intuiface connector purpose, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review the setup commands before installing. Prefer installing the oo CLI through a verified, version-pinned method or official documentation, and do not run the remote installer automatically. Once oo is already installed and connected, the skill's Intuiface actions are disclosed and write actions should require explicit confirmation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56
• Finding: Unverified Remote Installer Downloaded and Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 56–60 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute them using `bash` or PowerShell's `Invoke-Expression`. Neither command pins a specific installer version nor verifies a cryptographic signature or checksum before execution. HTTPS provides transport protection but does not guarantee that the server, DNS resolution, hosting account, or future script contents will remain trustworthy. Because the effective executable payload resides outside the audited project, it can change after this Skill is reviewed. Piping a response directly into a command interpreter also prevents meaningful inspection before execution. Installing the `oo` CLI is related to initial setup, but granting an unaudited remote response unrestricted shell execution exceeds the minimum privileges required for ordinary Intuiface operations. The Skill's normal behavior only requires an already-installed `oo` executable. ### Attack Path 1. The `oo` command is unavailable and an agent or user follows the first-time setup instructions. 2. The system retrieves `install.sh` or `install.ps1` from the remote OOMOL endpoint. 3. An attacker compromises the distribution server, hosting account, DNS path, or installer publication process, or otherwise causes the endpoint to return a modified payload. 4. The downloaded response is passed directly to `bash` or `Invoke-Expression` without integrity verification or review. 5. The modified installer executes with all privileges available to the invoking shell. 6. The payload can read or modify accessib ...[truncated 736 chars]
• Remediation: ## Remediation Suggestions 1. Remove all `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation patterns. 2. Prefer a trusted operating-system package manager or an official, version-pinned release package. 3. Download the installer or package as a separate step so it can be inspected before execution. 4. Pin an explicit CLI version rather than retrieving an unversioned, mutable installer. 5. Publish a SHA-256 or stronger checksum through an independently protected channel and verify it before execution. 6. Prefer cryptographic package signatures with a documented, pinned signing key and fail closed if verification fails. 7. Run installation with ordinary user privileges unless a narrowly defined operation specifically requires elevation. 8. Document the files, network endpoints, and system changes the installer is expected to use. 9. Keep setup user-initiated and require explicit confirmation before downloading or executing any installer. 10. For example, use a staged process: download a versioned artifact, verify its signature and checksum, inspect it, and only then invoke the installer.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill includes a one-line remote install command that downloads a script over the network and pipes it directly into a shell. If an agent follows this fallback guidance automatically, a compromised host, CDN, DNS path, or install endpoint could lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger text is intentionally broad: it instructs the agent to use this skill for ANY Intuiface request instead of calling the API directly. This can cause over-selection of the skill in situations where a narrower or safer tool would be more appropriate, increasing the chance of unintended actions or unnecessary exposure to connector-mediated writes.

Static analysis

No suspicious patterns detected.