Landbot

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:51 AM UTC
• Version: 1.0.2

Overview

The Landbot skill is mostly purpose-aligned, but it uses an unsafe remote installer pattern and grants broad local `oo` CLI authority, so users should review it before installing.

Install only if you trust OOMOL and are comfortable with the `oo` CLI access model. Prefer installing the CLI through a verifiable package or reviewed installer instead of piping a remote script into a shell, and require explicit confirmation before any Landbot write action is run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Installer Download and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Complete Code Snippet ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The documented installation commands retrieve mutable scripts from external URLs and immediately execute them in Bash or PowerShell. They do not pin an immutable installer version, verify a cryptographic signature or checksum, save the script for inspection, or otherwise establish that the downloaded content matches the version reviewed with this Skill. HTTPS protects the connection in transit under normal conditions, but it does not eliminate risks arising from compromise of the vendor's web infrastructure, DNS or certificate ecosystem, deployment pipeline, or publishing credentials. Because the effective installer payload can change after the Skill has been audited, a compromised endpoint can convert this setup instruction into arbitrary code execution. Installing the CLI may be necessary for the declared functionality, but immediate execution of unverified network content is not the minimum-risk installation mechanism. ### Attack Path 1. An attacker compromises or gains control over `cli.oomol.com`, its deployment pipeline, or another component capable of changing or redirecting the installer response. 2. The `oo` command is unavailable on a user's system, causing the documented first-time setup path to be selected. 3. The Agent or user runs the applicable `curl | bash` or `irm | iex` command. 4. The shell executes the attacker's response without integrity validation or prior inspecti ...[truncated 710 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove both direct download-to-shell patterns. - Direct users to an official package manager or immutable release artifact pinned to a specific CLI version. - Download the artifact to disk without executing it automatically. - Publish and verify a cryptographic signature or a checksum obtained through an independently authenticated channel. - Abort installation if verification fails. - Allow users to inspect the installer before execution. - Require explicit user approval before installing software or executing an installer. - Run installation with ordinary user privileges unless a narrowly defined step demonstrably requires elevation. - Document the expected version, source, checksum or signing identity, files created, and permissions required. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4
• Finding: Overly Broad oo CLI Tool Authorization<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Excessive tool authorization violating least privilege **Risk Level**: Medium ### Complete Code Snippet ```yaml allowed-tools: [Bash(oo *)] ``` ### Technical Analysis The wildcard authorizes Bash execution of every command matching `oo *`. The Skill's declared functionality only requires schema inspection and execution of five documented Landbot connector actions. The permission does not itself restrict calls to the `landbot` connector, the documented action names, or the two required command families. Consequently, the authorization boundary is broader than the Skill's stated purpose. If malicious instructions, prompt injection, or an Agent error influences command construction, the existing grant may permit unrelated `oo` operations without requesting a more specific authorization. The actual effect depends on which commands and connected services are available to the authenticated OOMOL account, but the wildcard unnecessarily increases the potential scope. ### Attack Path 1. The Skill is loaded with authorization to execute commands matching `oo *`. 2. Attacker-controlled content, an injected instruction, or an Agent error causes construction of an `oo` command outside the intended Landbot workflow. 3. The broad wildcard accepts the command because it begins with `oo`. 4. The CLI executes the operation using the user's authenticated OOMOL session and its available permissions. 5. If the account exposes unrelated commands, connectors, or administrative capabilities, those capabilities may be accessed beyond the declared Landbot task. ### Impact Assessment The grant potentially exposes any functionality available through the installed `oo` CLI and authenticated account, rather than only Landbot operations. Depending on account permissions and CLI capabilities, this could permit access to unrelated connector data or unau ...[truncated 294 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `Bash(oo *)` with the narrowest command patterns supported by the Skill permission system. - Permit only `oo connector schema` and `oo connector run`. - Enforce `landbot` as the connector identifier. - Allowlist only the documented actions: `get_customer_messages`, `list_channels`, `list_customers`, `send_text`, and `set_customer_field`. - Deny arbitrary additional flags, subcommands, connector names, and shell composition where the authorization mechanism supports such restrictions. - Validate generated JSON against the retrieved action schema before execution. - Retain explicit user confirmation for `send_text` and `set_customer_field`. - If sufficiently granular declarative restrictions are unavailable, use a small audited wrapper that validates connector, action, arguments, and payload before invoking the CLI. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into the shell (`curl ... | bash`). This is dangerous because it executes unverified code from the network immediately; if the hosting site, transport, DNS, or distribution path is compromised, an attacker can achieve arbitrary code execution on the user's system.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Landbot request" and "Whenever a task involves Landbot," which is a very broad activation condition for a manifest/markdown file. It does not define boundaries, exclusions, or negative examples, so ordinary references to Landbot could trigger the skill unintentionally.

Static analysis

No suspicious patterns detected.