JustCall

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:31 AM UTC
• Version: 1.0.0

Overview

This JustCall connector is mostly clear about its purpose, but its fallback setup tells users to execute remote installer scripts directly in a shell.

Review the setup path before installing. Prefer installing the oo CLI through a pinned release, trusted package manager, or verified download, and confirm exact payloads before allowing create, update, or delete actions in JustCall.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 62–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download scripts from external URLs and immediately execute them with `bash` or PowerShell's `Invoke-Expression`. The downloaded content is not pinned to a reviewed version, saved for inspection, or validated using a cryptographic signature or trusted checksum. Consequently, the effective code executed by this Skill can change after the Skill itself has been reviewed. HTTPS protects the connection in transit but does not protect against a compromised distribution server, malicious changes at the source, compromised publishing credentials, or an unexpected replacement of the remote script. Although installation is only presented as a fallback when the `oo` command is unavailable, installing a CLI does not inherently require piping mutable network content directly into a shell. This method therefore exceeds the minimum privilege and trust required for the declared JustCall connector functionality. ### Attack Path 1. The user or agent attempts to use the Skill on a system where the `oo` CLI is unavailable. 2. The documented fallback directs the user or agent to request `install.sh` or `install.ps1` from `cli.oomol.com`. 3. The response body is passed directly to `bash` or `Invoke-Expression` without inspection or integrity verification. 4. If the remote payload or its distribution infrastructure has been compromised, attacker-controlled commands execute with the privileges of the invoking account. 5. Those commands may access data available to that account, modify local files, install additional software, or establish persistence outside the reviewed S ...[truncated 624 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct download-to-shell pipelines. 2. Pin installation instructions to a specific, immutable CLI release rather than a mutable installation endpoint. 3. Download the installer or release artifact to a local file without executing it: ```bash curl -fL -o oo-installer.sh "https://example.invalid/path/to/pinned/oo-installer.sh" ``` 4. Publish and verify a cryptographic signature or a trusted SHA-256 checksum before execution. 5. Permit users to inspect the downloaded artifact before running it. 6. Execute installation with ordinary user privileges unless a documented installation step strictly requires elevation. 7. Prefer a signed operating-system package, a trusted package manager, or a reproducible release artifact from the documented upstream repository. 8. Document the expected files, network destinations, and system changes made by installation. 9. If an automated installer remains necessary, vendor and review a fixed version within a controlled release process rather than executing content that can change independently of the Skill. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install the CLI via a remote script piped directly to bash, which executes unreviewed code fetched at runtime. If the install endpoint, transport, or upstream distribution chain is compromised, this becomes arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The description says to use this skill for "ANY JustCall request," which is an overly broad trigger that can cause the agent to invoke the skill in situations where direct handling, narrower tooling, or additional user confirmation would be more appropriate. In a skill that supports reading, creating, updating, and deleting data, broad auto-selection increases the chance of unintended state-changing operations or unnecessary exposure of connected-account data.

Static analysis

No suspicious patterns detected.