LangSmith

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:14 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for LangSmith use, but its setup instructions include unverified internet installer commands that can execute code on the user's machine.

Review before installing. Use this skill only if you are comfortable routing LangSmith action payloads through OOMOL, and avoid running the documented pipe-to-shell installer unless you have independently verified the installer source and trust it. Confirm all write actions and avoid sending secrets in dataset inputs, outputs, or metadata unless required.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Unverified Remote Installer Downloaded and Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 64–68 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute them using Bash or PowerShell. Neither command pins a specific installer version nor verifies a cryptographic checksum or digital signature before execution. Although installing the `oo` CLI supports the Skill's declared functionality, direct pipe-to-shell execution is not the minimum-risk installation mechanism. The effective code can change after the Skill has been audited. Consequently, trust is transferred to the remote host, its deployment pipeline, DNS resolution, the TLS trust chain, and the integrity of every infrastructure component involved in delivering the installer. The document limits installation to cases where the CLI is missing, which reduces how frequently this path is used, but it does not mitigate the unverified execution risk. ### Attack Path 1. The `oo` command is unavailable, causing the Agent or user to follow the first-time setup instructions. 2. An attacker compromises the installer host, release pipeline, or another component capable of modifying the remotely served script. 3. The installer URL returns attacker-controlled shell or PowerShell code. 4. `bash` or `iex` executes the response immediately, without prior review or integrity verification. 5. The payload performs arbitrary actions with the privileges of the user or Agent process that launched the command. ### Impact Assessment A successful exploit could provide arbitrary code execution under the invoking account. Depending on that account's permissions and the host configuration, a ...[truncated 820 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation patterns. 2. Prefer a trusted operating-system package manager or an officially signed, version-pinned release package. 3. If a standalone installer is required: - Download it to a local file without executing it. - Pin the installer to a specific immutable release. - Obtain a published checksum through a separately protected channel. - Verify the checksum and, preferably, a platform-appropriate digital signature. - Abort installation if verification fails. - Execute the verified file without elevated privileges unless elevation is explicitly required and justified. 4. Document the files, directories, network endpoints, and permissions used by the installer so users can assess its effects before execution. 5. Keep installation an explicit, user-approved action rather than allowing an Agent to execute it automatically. 6. Advise users not to include secrets in connector action payloads unless required by the intended LangSmith operation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill includes a one-line remote script execution pattern (`curl ... | bash`), which fetches code from the network and immediately executes it without verification. If this fallback is triggered, a compromised host, MITM position, DNS hijack, or upstream supply-chain compromise could lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill mandates use for "ANY LangSmith request" and instructs the agent to prefer the skill over direct API access, creating an overly broad trigger scope. That increases the chance the skill is invoked in contexts where its setup and execution instructions are unnecessary or risky, including tasks that could prompt shell execution or fallback setup behavior unrelated to the user's core goal.

Static analysis

No suspicious patterns detected.