KIE.AI

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:23 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a narrow KIE.AI connector, but its setup instructions include unverified remote installer commands that execute downloaded scripts.

Install only if you are comfortable using OOMOL's oo CLI for KIE.AI and prefer installing that CLI yourself from a trusted, inspectable source. Avoid letting an agent run the provided curl-to-bash or irm-to-iex commands automatically; verify the installer source, version, and integrity first.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56
• Finding: Unverified Remote Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 56–60 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external server and immediately pass them to Bash or PowerShell for execution. The downloaded content is not pinned to a specific release, saved for review, checked against a trusted cryptographic digest, or verified using a publisher signature. HTTPS provides transport protection but does not establish that the script itself is safe. Compromise of the hosting server, domain, content-delivery infrastructure, or release pipeline could cause arbitrary replacement content to execute without any corresponding change to the reviewed Skill. This behavior exceeds the minimum privileges required for the declared read-oriented KIE.AI operations. Although installation is presented as a conditional first-time setup step, invoking it grants the current remote response arbitrary code-execution capability under the permissions of the user running the agent. ### Attack Path 1. The agent attempts to use the documented `oo` connector commands. 2. The command fails because the `oo` CLI is not installed. 3. Following the first-time setup instructions, the agent invokes the relevant installation command. 4. The shell downloads the current contents of `install.sh` or `install.ps1`. 5. The response is passed directly to Bash or PowerShell without inspection or integrity verification. 6. If the hosting or delivery infrastructure has been compromised, attacker-controlled commands execute locally with the invoking user's permissions. ### Impact Assessment A malicious installer response could execute arbitrary commands, read or mo ...[truncated 592 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` execution instructions. 2. Pin installation to a specific, reviewed CLI version rather than a mutable installer URL. 3. Download the installation artifact to disk without executing it. 4. Publish and verify a cryptographic signature from a trusted release key. At minimum, verify a pinned SHA-256 digest obtained through an independent trusted channel. 5. Prefer an official package manager or signed release artifact with reproducible versioning and integrity metadata. 6. Require explicit user approval before installing software or executing any downloaded artifact. 7. Run installation with ordinary user privileges unless a narrowly defined installation operation demonstrably requires elevation. 8. Display the artifact source, version, expected digest, and requested permissions before execution. 9. Keep CLI installation outside normal Skill execution where possible; document it as a user-managed prerequisite instead of allowing an agent to bootstrap executable code automatically. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill includes a one-line remote installer that fetches a script over the network and pipes it directly into a shell. If the remote host, transport, distribution pipeline, or script content is compromised, this can lead to immediate arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description instructs the agent to use this skill for "ANY KIE.AI request" and to prefer it over direct API use, which is an overly broad routing rule. This can cause unintended activation in contexts the user did not explicitly request, expanding the chance that the agent runs shell-based connector commands or follows risky setup paths unnecessarily.

Static analysis

No suspicious patterns detected.