Jushuitan ERP

• Outcome: Review
• Latest audit: Sep 7, 2026 · 9:57 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Jushuitan ERP connector, but its first-time setup tells users to execute remote installer scripts directly, which deserves review before installation.

Review the OOMOL CLI installation path before using this skill. Prefer a pinned package, a downloaded installer with a published checksum or signature, or manual inspection before execution. Once installed, only approve write actions after checking the exact Jushuitan payload and expected business effect.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:217
• Finding: Unpinned Remote Installation Scripts Are Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 217-221 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute them with Bash or PowerShell. The downloaded content is not pinned to a version, inspected, signature-verified, or checked against a published cryptographic digest before execution. The domain is consistent with the declared OOMOL service, and the instructions are limited to first-time setup after an `oo: command not found` error. Nevertheless, the effective payload is external to the audited Skill and can change after review. A compromise of the hosting infrastructure, distribution account, DNS resolution, TLS termination, or installation script could therefore turn an otherwise legitimate setup path into arbitrary local code execution. This mechanism exceeds the minimum privileges required to document or invoke the Jushuitan ERP connector: installing the CLI may be necessary for operation, but piping mutable network content directly into an interpreter is not necessary. ### Attack Path 1. The `oo` CLI is absent and an attempted connector command fails with `oo: command not found`. 2. The Agent or user follows the first-time setup instructions in `SKILL.md`. 3. `curl` or `Invoke-RestMethod` downloads the current installation script from the remote server. 4. The pipeline passes the response directly to Bash or `Invoke-Expression`, without local inspection or integrity verification. 5. If the remote script or its delivery path has been compromised, attacker-controlled commands execute with the privileges of the user running the installation. 6. Those commands could access files an ...[truncated 1251 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct download-to-interpreter pipelines. 2. Prefer a trusted platform package manager with a pinned CLI version. 3. If standalone scripts are required: - Download the script or versioned installer artifact to a local file without executing it. - Pin an immutable release version rather than using a mutable generic URL. - Publish and verify a SHA-256 or stronger digest. - Verify a publisher signature through a documented trust chain. - Display the source and obtain explicit user approval before execution. - Execute the installer with ordinary user privileges unless a specific operation demonstrably requires elevation. 4. Document the files, directories, network destinations, and configuration changes performed by the installer. 5. Keep installation user-initiated. The Agent should report that the CLI is missing and provide verified instructions rather than autonomously executing installation code. 6. For PowerShell, avoid `Invoke-Expression`; invoke a locally downloaded and verified script through an explicit, constrained command. 7. For Bash, avoid `curl | bash`; use a sequence equivalent to download, verify, inspect or approve, and then execute. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to use it for ANY Jushuitan ERP request, which creates an overly broad trigger scope and increases the chance of unintended invocation. In a skill that exposes both read and many write-capable ERP actions, accidental routing can lead to unnecessary access to sensitive business data or execution of state-changing operations when a narrower, more specific skill would have been safer.

Static analysis

No suspicious patterns detected.