Keeper SCIM

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent read-only Keeper SCIM connector, but its setup instructions include unverified remote installer commands that could execute arbitrary code on the user's machine.

Review before installing. The Keeper SCIM actions themselves are read-only and the OOMOL credential flow is disclosed, but do not let an agent automatically run the remote installer commands. Install the oo CLI through an approved, verified method, then use this skill only for the listed read operations unless future versions clearly document write actions and approval steps.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56
• Finding: Unverified Remote Installation Scripts Are Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 56–65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis Both installation commands retrieve mutable content from an external server and execute it immediately in a local shell. The Bash command pipes the HTTP response directly into `bash`, while the PowerShell command passes it to `Invoke-Expression`. The instructions provide no exact version pinning, cryptographic signature or checksum verification, payload inspection, or sandboxing. HTTPS protects data in transit, but it does not ensure that the served installer is trustworthy if the hosting account, web server, DNS infrastructure, certificate issuance process, or upstream release pipeline is compromised. The effective code can also be changed after this Skill has been reviewed without any corresponding change to `SKILL.md`. Installing a CLI may be relevant to the declared functionality, but arbitrary remote shell execution exceeds the minimum privileges required to perform read-only Keeper SCIM queries. Installation should remain an explicit, separately controlled prerequisite rather than an Agent-executable fallback. ### Attack Path 1. The `oo` CLI is absent, causing an `oo: command not found` error. 2. The Skill follows the documented first-time setup fallback. 3. It requests `install.sh` or `install.ps1` from `cli.oomol.com`. 4. An attacker who has compromised the delivery domain, hosting environment, DNS path, or release pipeline supplies a modified response. 5. The response is passed directly to Ba ...[truncated 1151 chars]
• Remediation: ## Remediation Suggestions 1. Remove both direct execution patterns: - `curl ... | bash` - `irm ... | iex` 2. Require users or administrators to install the CLI separately through an approved software deployment process. 3. Pin an exact CLI release rather than retrieving a mutable default installer. 4. Download the installer or package without executing it, then verify a vendor-published cryptographic signature or a checksum obtained through an independently trusted channel. 5. Prefer a trusted package manager or a signed, versioned release artifact with provenance information. 6. Display the verified artifact and intended installation effects to the user before requesting explicit approval to execute it. 7. Run installation with the least-privileged account possible and avoid administrative elevation unless a documented installation step strictly requires it. 8. Maintain an allowlist of expected download hosts and release-signing identities, and reject redirects or verification failures. 9. Keep installation outside automatic error-recovery behavior so a missing dependency cannot silently transition into remote code execution.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 96% confidence
• Finding: The skill recommends installing software via `curl ... | bash`, which executes a remotely fetched script without prior verification, integrity checking, or user review. If the distribution endpoint, network path, or hosting account is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrase instructs the agent to use this skill for ANY Keeper SCIM request instead of calling the API directly, which is overly broad and can capture tasks beyond the minimal intended scope. In an agent ecosystem, broad routing language increases the chance of unintended invocation, reducing least-privilege control and potentially causing data exposure through an unnecessary connector path.

Static analysis

No suspicious patterns detected.