KlickTipp

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:10 AM UTC
• Version: 1.0.3

Overview

The skill is for a real KlickTipp integration, but it under-labels account-changing actions as safe reads and includes an unverified remote installer command.

Review this skill before installing. It may be useful if you intentionally want an OOMOL-backed KlickTipp connector, but treat every listed action as account-changing: confirm the exact email address, payload, and expected effect before running it. Avoid pipe-to-shell installation unless you independently trust and verify the OOMOL CLI installer source.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Installation Scripts Are Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57-61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable content from `cli.oomol.com` and immediately execute it using Bash or PowerShell. The downloaded scripts are not pinned to an immutable version and are not verified using a cryptographic signature or checksum before execution. Although the hostname corresponds to the declared OOMOL service and installation is presented as a conditional first-time setup step, this design creates a remote code-execution channel whose effective payload can change after the Skill has been reviewed. It exceeds the minimum privileges necessary to document or invoke the KlickTipp connector because installation could instead use a pinned, independently verified package. The audit found no evidence that the current remote scripts are malicious. However, the package does not contain those scripts, so their contents and future behavior cannot be established from the audited artifact. ### Attack Path 1. The `oo` command is unavailable on the target system. 2. The Agent or user follows the first-time setup instructions. 3. The shell downloads the current installation script from `cli.oomol.com`. 4. The script is passed directly to Bash or PowerShell without local inspection, version pinning, checksum validation, or signature verification. 5. If the distribution endpoint, publishing account, DNS/TLS trust chain, or hosted script is compromised, attacker-controlled commands execute with the privileges of the user running the installation command. ### Impact Assessment Successful exploitation permits arbitrary command execution under the installing user's security ...[truncated 584 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace pipe-to-shell installation with a pinned release from an official, verifiable distribution channel. 2. Download the installer or package to a local file without executing it automatically. 3. Publish and verify a cryptographic signature or a checksum obtained through an independent trusted channel. 4. Pin the installer to an immutable version rather than retrieving the mutable latest script. 5. Prefer signed operating-system packages or package-manager distributions where available. 6. Display the exact source, version, checksum, and intended effects before installation. 7. Require explicit user approval before executing any downloaded installer. 8. Run installation with ordinary user privileges unless a specific, documented operation requires elevation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39
• Finding: State-Changing KlickTipp Actions Are Incorrectly Classified as Safe Reads<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39-46 **Vulnerability Type**: Unsafe action classification and missing confirmation controls **Risk Level**: Medium ### Vulnerable Code ```markdown ## Available actions - `signin` — Create or update a subscriber and associate the tag linked to the KlickTipp Listbuilding API key. - `signoff` — Unsubscribe a contact by email address through the KlickTipp Listbuilding API key. - `signout` — Remove the tag linked to the KlickTipp Listbuilding API key from a subscriber by email address. ## Safety - Untagged actions are reads (get / list / search) — safe to run directly. ``` ### Technical Analysis The Skill states that untagged actions are read-only and safe to execute directly. However, none of the available actions has a `[write]` or `[destructive]` tag, even though their descriptions explicitly identify state-changing behavior: - `signin` creates or updates a subscriber and associates a tag. - `signoff` unsubscribes a contact. - `signout` removes a tag from a subscriber. Consequently, the safety policy misclassifies every listed action as a read. This bypasses the confirmation requirements described elsewhere in the Skill for write and destructive operations. The network transfer involved in invoking the OOMOL connector is consistent with the declared KlickTipp integration, and the reviewed file contains no evidence of covert transmission to an unrelated recipient. Nevertheless, action payloads may contain subscriber email addresses and result in externally visible account changes, making accurate classification and user authorization necessary. ### Attack Path 1. A user asks the Agent to perform a KlickTipp-related operation. 2. The Agent reviews the action list and finds the relevant action without a `[write]` or `[destructive]` tag. 3. The Skill's safety rule classifies that untagged action as a safe read. 4. The Agent constructs a payload, potentially containing a subscriber ema ...[truncated 992 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Mark `signin` as `[write]`. 2. Mark `signoff` and `signout` as `[destructive]`, or at minimum `[write]` with enhanced confirmation requirements. 3. Require explicit approval before executing any of the three currently listed actions. 4. Before confirmation, display the exact action, target email address, submitted fields, and expected state change. 5. Validate the live connector schema before execution, but do not treat schema validation as a substitute for authorization. 6. For unsubscribe and tag-removal operations, use a two-step confirmation flow that clearly identifies the affected subscriber. 7. Replace the broad rule that every untagged action is a read with an explicit allowlist of verified read-only actions. 8. Default unknown or newly introduced actions to write-sensitive status until their behavior has been reviewed. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes the skill as suitable for 'searching and reading data', but the documented actions include `signin`, `signoff`, and `signout`, all of which modify subscriber state or tags. This mismatch can mislead an agent into invoking the skill in situations where only read-only behavior was expected, increasing the risk of unauthorized writes or destructive contact changes without appropriate user confirmation.

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 93% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which executes a remote script directly without prior verification or integrity checking. If the distribution endpoint, network path, or hosting account is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The safety section says state-changing actions will be marked with `[write]` or `[destructive]`, and that untagged actions are reads, but the listed actions are not tagged despite being mutating operations. This creates unsafe ambiguity for downstream agents or users who may rely on those labels to decide whether an action is safe to execute automatically.

Static analysis

No suspicious patterns detected.