IPLocate

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:10 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent IPLocate connector, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Review this skill before installing if you do not already trust OOMOL's installer channel. The IPLocate lookup behavior is narrow and read-focused, but avoid running the documented curl | bash or irm | iex setup commands automatically; prefer a verified, signed, or package-manager installation path for the oo CLI and confirm account connection steps yourself.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Shell Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable script from an external URL and pipes it directly into Bash. The downloaded content is not pinned to a version, verified against a cryptographic checksum, or authenticated with a code-signing signature before execution. Although HTTPS protects the connection in transit, it does not guarantee that the remote script remains unchanged after the Skill has been audited. This behavior creates a remote code-execution channel controlled by the content served from `cli.oomol.com`. Executing an installer can be necessary for first-time setup, but direct `curl | bash` execution exceeds the minimum safe privileges and trust required for the declared IP lookup functionality. The Skill itself only needs access to the `oo` connector command; it does not inherently require arbitrary, unverified code to be executed on the host. ### Attack Path 1. The `oo` command is unavailable, causing the documented first-time setup condition to occur. 2. A user or agent follows the installation instruction in `SKILL.md`. 3. The system downloads the current content of `https://cli.oomol.com/install.sh`. 4. The remote service, its publishing account, DNS path, or release infrastructure has been compromised, or the hosted script has otherwise been maliciously modified. 5. Bash immediately executes the downloaded content without inspection or integrity verification. 6. The payload performs arbitrary actions using the privileges of the user who invoked the command. ### Impact Assessment A malicious installer could execute arbitrary commands with the invoking user's privileges. Depending on those privileges and the local environment, this could ...[truncated 609 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the direct `curl | bash` installation pattern. - Direct users to a versioned release artifact from an official, authenticated release channel. - Pin the installer to a specific version and publish a cryptographic SHA-256 or stronger checksum through a separately protected channel. - Require users to download the artifact first, verify its checksum and code-signing signature, inspect it where practical, and only then execute it. - Prefer a reputable platform package manager that supports signed metadata and version pinning. - Avoid automatically installing the CLI from the Skill. If the dependency is missing, stop and ask the user to complete the verified installation process explicitly. - Document the files, network access, and permissions required by the installer so users can evaluate whether they are proportionate. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote PowerShell Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: Critical ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The PowerShell setup instruction retrieves a script from an external server with `Invoke-RestMethod` (`irm`) and passes the response directly to `Invoke-Expression` (`iex`). This causes PowerShell to interpret the remote response as executable code without first storing, inspecting, version-pinning, hashing, or signature-checking it. The effective code is determined at execution time by the content served from the remote URL. Therefore, the payload can change after this Skill package has been reviewed. HTTPS alone does not mitigate compromise of the hosting service, publishing credentials, or upstream release process. Installing a prerequisite may be appropriate when the CLI is absent, but immediate execution of mutable remote code is not the least-privilege method needed to support IPLocate lookups. ### Attack Path 1. The `oo` CLI is unavailable on a Windows host. 2. A user or agent follows the PowerShell setup instruction. 3. `Invoke-RestMethod` retrieves the current response from `https://cli.oomol.com/install.ps1`. 4. An attacker who has compromised the remote service, publishing process, account, or related infrastructure supplies modified PowerShell content. 5. `Invoke-Expression` executes that content immediately. 6. The attacker's commands run in the current PowerShell security context. ### Impact Assessment The remote payload receives the same effective privileges as the PowerShell process. It could potentially: - Read, create, modify, or delete files available to the invoking user. - Extract accessible credentials, configuration, or authentication material. - Download and execute additional payloads. - Modify PowerShell profiles ...[truncated 408 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `irm ... | iex` pattern. - Distribute a versioned, signed installer through an official release mechanism. - Require the installer to be downloaded as a file before execution. - Verify both an independently published cryptographic checksum and a trusted Authenticode signature. - Use an official package manager with signature validation and version pinning where available. - Require explicit user approval before installation rather than allowing an agent to execute installation commands automatically. - Document expected publisher identity, artifact hash, installation paths, network destinations, and required permissions. - Run installation with ordinary user privileges unless a clearly documented component strictly requires elevation. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into the shell (`curl ... | bash`), which executes network-fetched code without prior verification. If the distribution endpoint, DNS, TLS trust chain, or hosting infrastructure is compromised, this can lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says to use this skill for "ANY IPLocate request" and "Whenever a task involves IPLocate," which is a very broad activation condition for a markdown skill file. It does not provide narrower trigger boundaries or negative examples, increasing the chance of unintended invocation whenever IPLocate is merely mentioned.

Static analysis

No suspicious patterns detected.