JobNimbus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 1.0.4

Overview

The skill is mostly coherent for JobNimbus work, but its setup instructions include unverified remote installer commands that could run changing code on a user's machine.

Before installing, review or manually install the oo CLI from a trusted, verified source rather than blindly running the pasted installer commands. For JobNimbus use, confirm every create or update payload because the skill can change business records through the connected account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59

Finding

Unverified Remote Installer Scripts Executed Directly by Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

markdown

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

text

### Technical Analysis

The instructions retrieve mutable scripts from `cli.oomol.com` and execute them immediately using Bash or PowerShell. Neither command pins a specific installer version, verifies a cryptographic signature or checksum, nor separates download from execution for inspection.

HTTPS provides transport protection but does not establish that the downloaded script is safe. If the hosting service, publishing account, DNS configuration, or deployment pipeline is compromised, the remote content can be replaced after this skill has been reviewed. The next user or agent following the setup instructions would then execute the changed payload.

Installing the required CLI is relevant to the skill's declared functionality, but direct pipe-to-shell execution exceeds the minimum privileges and risk necessary for installation. A separately downloaded, version-pinned, cryptographically verified package would provide the same functionality with a materially smaller attack surface.

### Attack Path

1. The `oo` CLI is unavailable, causing an `oo: command not found` error.
2. The user or agent follows the documented first-time setup procedure.
3. An attacker compromises or otherwise gains control over the remote installer delivery path.
4. The attacker replaces `install.sh` or `install.ps1` with a malicious payload.
5. `curl | bash` or `irm | iex` executes the payload without integrity verification or prior inspection.
6. The payload operates with all permissions hel
...[truncated 925 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct execution patterns:

   • Do not pipe curl output directly into Bash.
   • Do not pass downloaded PowerShell content to Invoke-Expression.

2. Publish versioned installation artifacts through an authenticated official release channel and pin the documented installation procedure to a specific version.

3. Download the artifact to a local file before execution. Do not execute it until verification succeeds.

4. Publish SHA-256 checksums through a separately protected channel and verify the downloaded artifact against the expected checksum. Prefer cryptographic release signatures with a pinned, independently distributed public key.

5. Provide package-manager installation methods where available, using signed repositories and fixed package versions.

6. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. Clearly identify any privileged steps rather than executing the whole installer as an administrator.

7. Document the expected files, network destinations, and system modifications made by the installer so users can assess the requested privileges.

8. For PowerShell, use a signed script with an appropriate execution policy and invoke the verified local file directly rather than using iex.

A safer high-level workflow is:

text

Download a version-pinned artifact
→ Verify its signature and published checksum
→ Inspect or validate the local artifact
→ Execute it with the minimum required privileges

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs the agent to install software via curl ... | bash, which executes a remote script without verification. If the remote host, distribution path, DNS, TLS trust chain, or script content is compromised, arbitrary code can run on the user's machine with the agent effectively facilitating remote code execution.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description says to use this skill for ANY JobNimbus request and instead of calling the API directly, creating an overly broad activation scope. That can cause the agent to invoke this skill in situations where a narrower, safer path would be more appropriate, including unintended write operations or use in loosely related contexts without sufficient user confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.