Klaviyo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:23 AM UTC
• Version: 1.0.3

Overview

This Klaviyo connector skill is mostly coherent, but its first-time setup tells users to execute remote installer scripts directly and it grants broad OOMOL CLI use for a write-capable integration.

Review the oo CLI installation path before installing. Prefer a pinned, checksum-verified installer or package-manager install, and only allow this skill to perform Klaviyo writes after confirming the exact payload and account impact.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61

Finding

Unverified Remote Installer Download and Immediate Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from external URLs and immediately execute them using bash or PowerShell's Invoke-Expression. Neither path pins an immutable release, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded script before execution.

HTTPS provides transport protection and server authentication, but it does not ensure that the installer remains unchanged after the Skill has been reviewed. If the distribution server, DNS resolution, TLS termination infrastructure, hosting account, or release pipeline is compromised, an attacker can replace the installer with arbitrary code.

The behavior is presented as a fallback for first-time setup rather than an operation required for each Klaviyo request. Installing the CLI may be necessary to use the Skill, but direct execution of unverified remote content exceeds the minimum privilege and trust necessary to perform that installation safely.

Attack Path

1. The oo command is unavailable, causing the user or agent to follow the first-time setup instructions.
2. curl or Invoke-RestMethod requests the current installer from cli.oomol.com.
3. The remote installer has been maliciously replaced or modified through a compromise of the hosting or delivery infrastructure.
4. The downloaded response is passed directly to bash or Invoke-Expression without local review or integrity verification.
5. The malicious payload executes with the privileges of the user running the command.
6. The payload can access resources available to that user and may downlo ...[truncated 1138 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove direct curl | bash and Invoke-RestMethod | Invoke-Expression execution patterns.
2. Pin installation instructions to a specific reviewed CLI version rather than a mutable installer endpoint.
3. Download the installer or release artifact to a local file before execution.
4. Publish and verify a cryptographic checksum or, preferably, a signed release artifact using a documented trusted signing key.
5. Display the source URL, selected version, destination path, and expected integrity value before installation.
6. Require explicit user approval before executing any downloaded installer.
7. Prefer a reputable platform package manager where packages are version-pinned and integrity-verified.
8. Run installation with ordinary user privileges unless elevation is demonstrably required; never recommend routine execution as root or administrator.
9. Document what the installer changes, including installed files, environment modifications, telemetry, update mechanisms, and any persistence components.
10. Clearly disclose that Klaviyo request data is processed through OOMOL and provide relevant privacy, retention, and access-control documentation.

A safer installation pattern is:

bash

curl -fL -o oo-installer.sh \
  "https://cli.oomol.com/releases/<PINNED_VERSION>/install.sh"

echo "<EXPECTED_SHA256>  oo-installer.sh" | sha256sum --check
less oo-installer.sh
bash oo-installer.sh

The release URL and checksum must be immutable and obtained through a trusted, authenticated publication channel.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install software via curl ... | bash, which executes a remotely fetched script directly in the shell without prior verification. If the hosting endpoint, transport, or distribution pipeline is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description says to use this skill for ANY Klaviyo request, which can cause the agent to route all Klaviyo-related tasks through a broad connector without narrower task scoping or least-privilege guidance. In a skill system, this increases the chance of unintended invocation and raises the risk that write-capable actions are selected in contexts where a more constrained path would be safer.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.