Kuaimai ERP

• Outcome: Review
• Latest audit: Sep 7, 2026 · 9:58 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Kuaimai ERP connector purpose, but it under-discloses a session-changing action and recommends unsafe remote installer commands.

Review this skill before installing. It is not evidence of malicious behavior, but users should avoid the pipe-to-shell installer commands unless they independently trust and verify the OOMOL installer, and should treat `refresh_session` as an account/session-changing action that requires explicit approval.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely retrieved, mutable script directly into Bash. The script is neither included in the audited project nor pinned to an immutable version. No cryptographic signature or checksum is verified before execution, and the user has no mandatory opportunity to inspect the downloaded content. Although `cli.oomol.com` is consistent with the declared OOMOL service, trust in the hostname alone does not adequately protect this execution path. Compromise of the domain, DNS resolution, TLS or hosting infrastructure, release pipeline, or installer content could cause arbitrary commands to be returned and immediately executed. Direct remote-script execution exceeds the minimum privilege required to explain how to install a connector CLI. Installation can instead use a version-pinned package whose integrity is verified before execution. ### Attack Path 1. The `oo` command is unavailable on the target system. 2. The agent or user follows the documented first-time setup procedure. 3. An attacker compromises or gains control over the installer distribution path or its publishing pipeline. 4. `curl` downloads the attacker-controlled replacement for `install.sh`. 5. The shell pipe passes the response directly to Bash without integrity verification. 6. The payload executes with all privileges held by the user running the command. ### Impact Assessment A successful exploit provides arbitrary command execution under the invoking user's account. The payload could read or alter files accessible to that account, steal locally available credentials or session material, intercept ERP information, invoke network services, install add ...[truncated 193 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation instruction. - Prefer a trusted operating-system package manager with an explicitly pinned CLI version. - If a standalone installer is necessary, require users to download it to a local file first. - Publish and verify a cryptographic signature from a separately protected trust channel. At minimum, verify a release-specific SHA-256 digest before execution. - Use an immutable, versioned release URL rather than a mutable `install.sh` endpoint. - Allow the downloaded script to be reviewed before it is executed. - Run installation with ordinary user privileges unless a documented operation specifically requires elevation. - Document the files, network destinations, and permission changes performed by the installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` and immediately evaluates the response through `Invoke-Expression`. The remote script is outside the audited project and is not pinned, authenticated with a code-signing certificate, or checked against a release-specific cryptographic digest. `Invoke-Expression` treats the entire network response as executable PowerShell code. Consequently, compromise of the installer endpoint or its software delivery pipeline converts this documented setup path into arbitrary local code execution. The user is not required to save or inspect the script before it runs. This execution method grants the remote response broader capabilities than are minimally necessary to install the declared CLI. ### Attack Path 1. The `oo` command is unavailable on a Windows system. 2. The agent or user follows the documented first-time setup procedure. 3. An attacker compromises the installer endpoint, hosting infrastructure, or publishing pipeline. 4. `Invoke-RestMethod` retrieves attacker-controlled PowerShell content. 5. The pipeline sends that content directly to `Invoke-Expression`. 6. PowerShell executes the payload with the permissions and accessible resources of the invoking user. ### Impact Assessment A successful exploit permits arbitrary PowerShell execution as the invoking user. This can expose accessible files, credentials, session information, and ERP data; modify user configuration; download further payloads; communicate with external systems; or create persistence where permissions permit. Execution from an elevated PowerShell session could result in system-wide modification ...[truncated 15 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation instruction. - Distribute a versioned and Authenticode-signed PowerShell installer or a signed package through a trusted Windows package manager. - Require the installer to be downloaded as a file before execution. - Validate the publisher's code-signing certificate and a release-specific cryptographic digest before running the installer. - Avoid `Invoke-Expression`; execute only a locally stored, successfully verified script using an appropriate PowerShell execution policy. - Use an immutable release URL and document installer behavior and required permissions. - Instruct users to install without administrator privileges unless elevation is demonstrably necessary.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest and description position the skill as "searching and reading data," but the documented `refresh_session` action changes account/session state by extending session validity. This mismatch can cause downstream agents or users to treat the skill as read-only and invoke it without the stronger confirmation normally required for state-changing operations.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The safety section states that untagged actions are reads, yet `refresh_session` is untagged despite modifying session validity. This creates a direct policy/documentation contradiction that can mislead an agent into executing a state-changing action under read-only assumptions, bypassing intended approval gates.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The instruction to use this skill for ANY Kuaimai ERP request gives it overly broad authority, increasing the chance that an agent routes unrelated or higher-risk Kuaimai tasks through a skill whose safety boundaries are inaccurately documented. In context, this is more dangerous because the skill is advertised as read/search focused while also exposing a state-changing action.

Static analysis

No suspicious patterns detected.