JigsawStack

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:14 AM UTC
• Version: 1.0.3

Overview

The skill's JigsawStack connector behavior is coherent, but its setup instructions include unverified remote script execution, so it should be reviewed before installation.

Install only if you are comfortable trusting OOMOL's hosted installer path, or use a safer manual installation method with a pinned release and verified checksum/signature. After setup, review what data you send to JigsawStack because searches, documents, and text payloads are processed through the external connector service.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote Shell Script Execution via curl and Bash## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code:** ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable script from an external URL and pipes it directly into Bash. The downloaded content is neither displayed nor saved for inspection, and the command performs no cryptographic signature or checksum verification. Consequently, the code executed on the system can differ from the content that existed when this Skill was audited. Installing the `oo` CLI is relevant to the declared connector functionality, and the referenced domain is consistent with the declared OOMOL service. However, direct execution of unverified remote content exceeds the minimum privilege and trust necessary for installation. A compromised domain, TLS endpoint, hosting account, release pipeline, or installer could turn this command into an arbitrary-code-execution channel. ### Attack Path 1. A user invokes the Skill on a macOS or Linux system where the `oo` command is unavailable. 2. The Skill directs the user or agent to follow the first-time installation command. 3. An attacker compromises the installer hosting infrastructure, release pipeline, or remote script. 4. `curl` retrieves the attacker-controlled response from the mutable URL. 5. The shell pipeline passes the response directly to Bash without inspection or artifact verification. 6. Bash executes the attacker's commands with the permissions of the invoking account. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's privileges. The payload could read accessible files and credentials, alter project or user files, install additional software, establish persistence, or transmit sensitive information over the netwo ...[truncated 368 chars]
• Remediation: ## Remediation Suggestions - Replace the `curl | bash` pipeline with a pinned, versioned release artifact from the official distribution channel. - Download the installer to a local file rather than executing the network response immediately. - Publish and verify a cryptographic signature or a SHA-256 digest obtained through a separately authenticated channel before execution. - Allow the user to inspect the downloaded script and document the files, network destinations, and permissions it uses. - Prefer a platform package manager or signed package whose provenance and integrity can be independently verified. - Do not invoke the installer with `sudo` or another privileged account unless a documented operation strictly requires it.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote PowerShell Script Execution via Invoke-RestMethod## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code:** ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction retrieves a mutable PowerShell script using the `irm` alias for `Invoke-RestMethod` and immediately executes its response using the `iex` alias for `Invoke-Expression`. No version is pinned, and no signature, publisher identity, or cryptographic digest is checked before execution. Although installation of the declared OOMOL CLI supports the Skill's functionality, this construction creates a remote code-execution channel whose effective payload is controlled outside the audited package. Trust in HTTPS alone does not protect against compromise of the hosting service, installer publication process, domain account, or remote script contents. ### Attack Path 1. A user invokes the Skill on Windows where the `oo` command is unavailable. 2. The first-time setup instructions lead the user or agent to execute the PowerShell command. 3. An attacker modifies the hosted installer or compromises an infrastructure component capable of serving it. 4. `Invoke-RestMethod` downloads the modified response. 5. The pipeline supplies the response directly to `Invoke-Expression` without local inspection or integrity validation. 6. PowerShell executes the attacker's commands in the invoking user's security context. ### Impact Assessment Exploitation allows arbitrary PowerShell execution with all privileges held by the invoking account. An attacker could access user-readable files and credentials, modify the registry and filesystem where permitted, install secondary payloads, transmit sensitive information, or create persistence within the user's access scope. If launched from an elevated PowerShell session, the payl ...[truncated 186 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` execution pipeline. - Distribute a version-pinned, Authenticode-signed PowerShell script or signed installer package from an official release channel. - Download the artifact first and validate its Authenticode signature and expected publisher before running it. - If signature validation is unavailable, publish and verify a SHA-256 digest through a separately authenticated channel. - Expose the downloaded script for review and document its filesystem, registry, network, and permission effects. - Execute installation with ordinary user privileges unless a narrowly scoped, documented action requires elevation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs use of a classic curl-pipe-to-shell install command that executes a remote script without verification. If the install endpoint, network path, or hosting is compromised, users could run arbitrary code on their machine, and including this in a skill makes that risky behavior easier to trigger in operational workflows.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description says to use this skill for ANY JigsawStack request and instead of calling the API directly, which is an overly broad routing trigger. That can cause an agent to invoke the skill in situations it should not, including sensitive or unintended contexts, increasing the chance of unsafe command execution paths being reached.

Static analysis

No suspicious patterns detected.