iTunes Search API

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:51 PM UTC
• Version: 1.0.0

Overview

This read-only iTunes lookup skill is mostly coherent, but its setup instructions can run unverified remote installer scripts and it forces queries through an extra third-party service.

Install only if you are comfortable using OOMOL as an intermediary for iTunes searches and lookups. Do not let an agent run the installer commands automatically; inspect or install the `oo` CLI through a trusted, verified channel first, and avoid putting secrets or sensitive personal text in search payloads.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Unverified Remote Shell Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:55` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The setup instructions pipe content downloaded from a mutable external URL directly into Bash. The remote response is executed without a pinned version, cryptographic checksum, digital-signature verification, or an opportunity to inspect the downloaded file. HTTPS protects the connection in transit but does not establish that the current server-hosted script is identical to the version reviewed with this Skill. Compromise of the domain, hosting infrastructure, publishing account, or installer itself could therefore turn this instruction into arbitrary code execution. Installation is only needed when `oo` is unavailable, but executing an unconstrained remote script grants substantially broader capabilities than those required to perform read-only iTunes searches. ### Attack Path 1. The agent attempts to use `oo` and receives an `oo: command not found` error. 2. It follows the documented first-time setup instruction. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. A compromised or malicious server response supplies arbitrary shell commands. 5. Bash executes those commands immediately with the invoking user's privileges. 6. The payload may read accessible files and credentials, modify user configuration, install software, or establish persistence. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installer. This normally includes access to that user's files, environment variables, authentication material, and writable configuration. If the agent is running under an elevated account, or if the installer obtains elevation, system-wide compromise may be possibl ...[truncated 77 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the pipe-to-shell command with a version-pinned release artifact from a documented, trusted repository. 2. Download the installer to a local file without executing it: ```bash curl --proto '=https' --tlsv1.2 -fL -o oo-install.sh '<version-pinned-url>' ``` 3. Publish and verify a cryptographic digest or signed checksum before execution: ```bash echo '<expected-sha256> oo-install.sh' | sha256sum --check - ``` 4. Prefer a platform package manager or signed binary package with explicit version constraints. 5. Allow review of the downloaded script before running it and execute it as an unprivileged user. 6. Document all files, permissions, and network endpoints used by the installer. 7. Do not allow an agent to install the CLI automatically; require explicit user approval before any installation. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote PowerShell Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:59` **Vulnerability Type**: Remote payload retrieval and immediate PowerShell evaluation **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `Invoke-RestMethod` (`irm`) retrieves mutable content from an external server, and `Invoke-Expression` (`iex`) immediately interprets that response as PowerShell code. No release version, expected digest, Authenticode validation, or manual review boundary constrains the effective payload. The code evaluated during installation can change independently of the audited Skill. This creates a remote code-execution and supply-chain boundary in a workflow whose declared purpose is limited to read-only iTunes searches and lookups. ### Attack Path 1. The `oo` CLI is unavailable on a Windows host. 2. The agent or user follows the documented PowerShell setup command. 3. `Invoke-RestMethod` downloads the current response from `https://cli.oomol.com/install.ps1`. 4. An attacker who controls or compromises the delivery infrastructure substitutes malicious PowerShell. 5. `Invoke-Expression` evaluates the response without integrity validation. 6. The payload performs arbitrary actions available to the current PowerShell process. ### Impact Assessment Successful exploitation permits arbitrary PowerShell execution with the current user's permissions. The payload could access user-readable files and credentials, alter PowerShell profiles or other writable configuration, install software, and create persistence. System-wide effects are possible if PowerShell is running with administrative privileges. The audited file does not itself demonstrate a privilege-escalation technique. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `irm ... | iex` pattern. 2. Distribute a version-pinned installer or signed package through a documented release channel. 3. Download the installer without evaluating it: ```powershell Invoke-WebRequest -Uri '<version-pinned-url>' -OutFile '.\install.ps1' ``` 4. Verify a published SHA-256 digest and a trusted Authenticode signature before execution: ```powershell Get-FileHash .\install.ps1 -Algorithm SHA256 Get-AuthenticodeSignature .\install.ps1 ``` 5. Reject unsigned, invalidly signed, unexpectedly changed, or unpinned installer artifacts. 6. Run installation with the least-privileged account possible and require explicit user approval. 7. Prefer a signed MSI, Microsoft Store package, or trusted package-manager distribution over script evaluation. ]]>

other

Warning

• Location: SKILL.md:3
• Finding: Unnecessary Third-Party Routing of iTunes Query Data<; OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```bash oo connector run "itunes_search" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill mandates routing all iTunes Search API requests through the OOMOL connector instead of calling Apple's API directly. It also states that the iTunes Search API needs no account connection, indicating that an authenticated intermediary is not inherently required for the declared search and lookup functionality. The JSON supplied through `--data` is transmitted to OOMOL infrastructure for connector execution. Depending on the user's request, this may expose search terms, store identifiers, and other user-provided query values to an additional service. Responses also include an OOMOL execution identifier, allowing requests to be associated with connector executions. The audited file says that OOMOL injects credentials server-side and does not instruct the agent to collect or transmit raw tokens. Therefore, there is no evidence in the file of direct credential exfiltration. The confirmed concern is unnecessary third-party processing of request data and associated metadata. ### Attack Path 1. A user asks the agent to search or look up an iTunes Store item. 2. The Skill directs the agent not to call Apple's API directly. 3. The agent constructs a JSON pay ...[truncated 917 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit direct calls to Apple's public iTunes Search API as the default path for unauthenticated read-only searches and lookups. 2. Clearly disclose that the OOMOL connector receives query payloads and associated request metadata. 3. Obtain informed user consent before routing potentially sensitive query data through the intermediary. 4. Apply strict data minimization: send only fields required by the selected action and reject unrelated free-form or secret-bearing content. 5. Document applicable logging, retention, deletion, account-linking, and subprocessors policies. 6. Warn users not to include secrets, credentials, private personal data, or unrelated confidential content in search payloads. 7. If intermediary routing remains mandatory, provide a technical justification and a privacy-preserving mode that minimizes account association and telemetry. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description says to use this skill for ANY iTunes Search API request and instead of calling the API directly, which is broad enough to trigger the skill in cases where a narrower or more appropriate mechanism might be preferable. Over-broad routing can cause unintended skill activation, unnecessary external calls, and reduced user control over how requests are handled, especially in agentic systems that select tools based on descriptions.

Static analysis

No suspicious patterns detected.