Security audit

Keyword.com

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Keyword.com read connector, but its setup instructions tell users to run an unverified internet installer directly in a shell.

Review the setup path before installing. Prefer installing the oo CLI from a verified, pinned, or package-manager source, and only connect a Keyword.com account whose accessible projects and keywords you are comfortable exposing through OOMOL connector calls.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:60
Finding: Unverified Remote Installer Download and Immediate Execution
Content: View full analysis
Remediation: View remediation
install.sh' | sha256sum --check ``` 6. Where available, verify a vendor digital signature using a separately distributed and trusted public key. 7. Allow the user to inspect the downloaded script and require explicit confirmation before execution. 8. Run installation with ordinary user privileges unless a specific, documented operation genuinely requires elevation. 9. Document the files, network destinations, and permissions used by the installer. 10. For automated environments, distribute a pre-verified binary or package through an approved internal artifact repository. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs use of a remote installation command that pipes a fetched script directly into bash. If the install endpoint, transport, or upstream distribution is compromised, this leads to arbitrary code execution on the local machine without prior inspection.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger language is unusually broad: it directs use of this skill for ANY Keyword.com request and any task that involves Keyword.com. That can cause the agent to invoke the skill in cases where direct use is unnecessary or where the user only mentioned Keyword.com incidentally, increasing the chance of unintended external data access or command execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.