Security audit

Juniper Mist

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Juniper Mist connector, but it includes risky first-time installer commands and broadly routes Juniper Mist work through a third-party connector.

Install only if you are comfortable routing Juniper Mist profile, organization, site, and device data through OOMOL. Avoid running the provided one-line installer commands as written; prefer a verified, signed, or package-manager installation path for the oo CLI, and use the skill only for the listed read actions unless you explicitly approve any broader connector action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:57
Finding: Unverified Remote Shell Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable shell script from an external server and pipes it directly into Bash. The script is executed without version pinning, local inspection, checksum validation, or cryptographic signature verification. Although the URL uses HTTPS and appears to be associated with the advertised CLI vendor, transport encryption alone does not establish that the downloaded script is safe. A compromise of the vendor server, CDN, DNS infrastructure, TLS endpoint, or release pipeline could change the effective payload after this Skill has been reviewed. Installing the CLI may be necessary when it is unavailable, but immediately executing unverified remote content exceeds the minimum privilege necessary for installation. A safer process would separate download, verification, and execution. ### Attack Path 1. The `oo` command is unavailable on the macOS or Linux host. 2. The agent follows the first-time setup instructions in `SKILL.md`. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. The response is passed directly to Bash without integrity verification. 5. If the remote endpoint or delivery chain is compromised, attacker-controlled shell commands execute with the privileges of the user running the agent. 6. Those commands could access files and credentials available to that user, alter user-level configuration, install additional software, or establish persistence where permitted. ### Impact Assessment Successful exploitation provides arbitrary command execution under the current user's security context. The accessible scope includes the user's files, environment variables, locally available credentials, network access ...[truncated 271 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Pin the CLI to a specific, reviewed release rather than retrieving a mutable installer. - Download the installer or package to a local file without executing it. - Verify a vendor-published cryptographic signature and a checksum obtained through an independently protected channel. - Prefer an operating-system package manager or signed package format where available. - Display the resolved version, source, and requested privileges before installation. - Execute the verified artifact as a separate step under an unprivileged account. - Require explicit user approval before installing software or requesting privilege elevation. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:61
Finding: Unverified Remote PowerShell Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` and immediately evaluates it using `Invoke-Expression`. No fixed release version, checksum, Authenticode signature check, or manual review separates retrieval from execution. This design makes the remote server's response the effective executable payload. HTTPS protects the connection in transit but does not mitigate compromise of the hosting service, signing or release infrastructure, DNS/CDN chain, or vendor account. `Invoke-Expression` also removes the opportunity to inspect and validate the downloaded file before it runs. ### Attack Path 1. The `oo` command is unavailable on a Windows host. 2. The agent follows the Windows first-time setup instruction. 3. `Invoke-RestMethod` downloads the current response from `https://cli.oomol.com/install.ps1`. 4. The response is piped directly into `Invoke-Expression`. 5. A compromised delivery endpoint supplies attacker-controlled PowerShell. 6. PowerShell executes that content with the current process's privileges, allowing the attacker to perform any operation available to that user. ### Impact Assessment Successful exploitation enables arbitrary PowerShell execution in the current user's security context. An attacker could read or modify accessible files, collect credentials available to the process, make outbound network requests, change user-level configuration, or install persistent components where permissions allow. If PowerShell is running with administrative privileges, the impact could extend to system-wide configuration and all local users, although administrative execution is not explicitly required by the reviewed instructions. ]]>
Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `irm | iex` pattern and avoid evaluating downloaded text with `Invoke-Expression`. - Use a version-pinned, signed Windows package or installer from an official release repository. - Save the artifact locally before execution. - Validate both its expected checksum and Authenticode signature, including the signer identity and signature status. - Fail closed if verification cannot be completed. - Run the verified installer as a separate command with the lowest necessary privileges. - Require explicit user approval before software installation or administrative elevation. ]]>

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: Overbroad Mandatory Routing of Juniper Mist Requests Through a Third-Party Connector<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 3 **Vulnerability Type**: Skill instruction hijacking **Risk Level**: Medium ### Vulnerable Code ```yaml description: "Juniper Mist (juniper.net). Use this skill for ANY Juniper Mist request — searching and reading data. Whenever a task involves Juniper Mist, use this skill instead of calling the API directly." ``` ### Technical Analysis The Skill metadata directs the agent to use this Skill for every Juniper Mist request and explicitly prevents direct API use. This instruction is broader than the declared set of three read operations and alters tool selection based solely on the topic of a request rather than on explicit user consent or operational necessity. The selected workflow sends connector requests through OOMOL. The document discloses this architecture and states that credentials are injected server-side, so the reviewed content does not show raw-token theft or covert credential exfiltration. Nevertheless, mandatory third-party routing can expose requested and returned Juniper Mist information—including administrator profile, organization, site, and device data—to an intermediary even when direct access may be available or preferred. ### Attack Path 1. A user makes any request involving Juniper Mist. 2. The broad metadata instruction causes the agent to select this Skill automatically. 3. The Skill requires use of `oo connector schema` and `oo connector run` rather than direct API access. 4. The request payload and connector response are processed through OOMOL. 5. Juniper Mist operational information within the selected action's response is consequently placed within the third-party connector's processing scope. ### Impact Assessment The issue can affect the confidentiality and processing control of Juniper Mist profile, organization, site, and device information returned by the listed actions. It also restricts the user's control over tool and service-provider selection. T ...[truncated 340 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Replace the universal activation language with narrowly scoped, capability-based wording. - Do not prohibit direct API use when the user explicitly requests it or when policy permits it. - Obtain informed user approval before first routing Juniper Mist information through OOMOL. - Clearly disclose which request and response fields the intermediary receives, how they are retained, and which privacy controls apply. - Limit connector requests and returned fields to the minimum data required for the specific task. - Preserve the existing separation that keeps raw Juniper Mist credentials out of agent-visible input. - Provide an opt-out or direct-access alternative where supported. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest and description frame the skill as limited to searching and reading data, but the instructions explicitly allow use of arbitrary live connector actions and even discuss handling [write] and [destructive] operations. This creates a dangerous capability mismatch: an agent or reviewer may trust the skill as read-only while the runtime guidance permits state-changing actions against Juniper Mist.

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 98% confidence
Finding: The skill recommends installing software via a remote script piped directly into a shell (`curl ... | bash`), which is a classic supply-chain and arbitrary code execution risk. If the remote endpoint, TLS trust, distribution channel, or installer is compromised, an agent following this guidance would execute attacker-controlled code on the host.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description uses sweeping activation language with no constraints or negative examples. This makes it unclear when the skill should be invoked versus when a different tool or direct reasoning would be more appropriate.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill claims untagged actions are safe reads, yet it tells the agent to inspect the live connector schema for any action name and then run it. That means the effective behavior is not limited to the enumerated read-only actions in the document, so future or hidden connector actions could be invoked without the skill text being updated or reviewed.

Static analysis

No suspicious patterns detected.