Security audit

IT Glue

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only IT Glue connector guide, but it should be reviewed because its setup instructions run an unverified remote installer script.

Install only if you are comfortable using OOMOL's oo CLI and IT Glue connector. Treat the remote installer commands as manual setup steps to review first; prefer verified official packages or checksum/signature validation before running them, and avoid elevated shells unless strictly necessary.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:62
Finding: Unverified Remote Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 62–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download mutable content from an external server and pass it directly to a command interpreter. The Unix command pipes the HTTP response to `bash`, while the Windows command sends it to `Invoke-Expression`. No version pinning, cryptographic signature validation, checksum verification, or review step occurs before execution. Consequently, the code executed on a user's system can differ from the content that existed when the Skill was audited. Compromise of the hosting infrastructure, distribution path, DNS resolution, or installer publication process could turn these commands into an arbitrary-code-execution channel. Installing the required CLI is related to the Skill's declared IT Glue integration, but immediate execution of an unverified network response exceeds the minimum safe trust and privilege requirements. A safer installation process can download a fixed release, verify its integrity, and obtain user approval before execution. ### Attack Path 1. The Skill attempts to use the `oo` CLI and receives an `oo: command not found` error. 2. A user or agent follows the documented first-time installation fallback. 3. The command retrieves the current installer response from `cli.oomol.com`. 4. An attacker who has compromised the installer host, release process, CDN, DNS path, or equivalent delivery infrastructure substitutes malicious script content. 5. The shell or PowerShell interpreter executes the response immediately without integrity verification. 6. The substituted payload operates with the privileges of the invoking user and may access any ...[truncated 587 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct pipe-to-interpreter installation commands. 2. Direct users to an authenticated official release page or trusted platform package manager. 3. Pin the CLI to a specific reviewed version rather than retrieving a mutable latest installer. 4. Download the installer or package to disk without executing it automatically. 5. Publish and verify a cryptographic signature from a separately trusted signing key. If signatures are unavailable, verify a version-specific SHA-256 checksum obtained through an independently protected channel. 6. Display the resolved version, download source, expected permissions, and verification result before requesting explicit user approval. 7. Execute the verified installer without administrator privileges unless a documented installation operation strictly requires elevation. 8. Prefer a sequence such as download, integrity verification, inspection, approval, and execution rather than combining retrieval and execution in one command. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest says the skill is for searching and reading data, but the body describes support for state-changing actions via the same connector. That mismatch can mislead an agent or reviewer into invoking the skill under a read-only trust assumption when the underlying interface may permit writes, increasing the chance of unintended modification if additional actions become available.

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 98% confidence
Finding: The skill instructs users to install software by piping a remote script directly into bash. This is a classic supply-chain and remote code execution risk: if the distribution endpoint or transport is compromised, arbitrary code runs immediately on the host without integrity verification or user review. In a skill context, this is more dangerous because an agent may execute troubleshooting steps mechanically.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase says to use this skill for ANY IT Glue request instead of calling the API directly, which is overly broad. Broad routing can cause the agent to invoke the skill in contexts it was not narrowly reviewed for, increasing exposure to unintended commands, setup steps, or future connector capabilities.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The safety section states that untagged actions are reads and references write/destructive tags, but the listed actions are all reads. This creates ambiguous security expectations: if the live schema later exposes additional actions not documented here, an agent may overtrust untagged behavior or assume the documented list is complete.

Static analysis

No suspicious patterns detected.