Leadfeeder

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:29 AM UTC
• Version: 1.0.3

Overview

The skill is a coherent Leadfeeder integration, but its setup instructions include unverified remote installer commands that can execute changing code on a user's machine.

Install only if you trust OOMOL and are comfortable with Leadfeeder data flowing through its connector. Avoid running the documented one-line installer directly; prefer official, versioned installation instructions with a signed package or checksum verification, and only connect the Leadfeeder account/scopes you intend this skill to use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Bash Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61` **Vulnerability Type**: Remote payload retrieval and execution through `curl | bash` **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The first-time setup instructions download a mutable shell script from `https://cli.oomol.com/install.sh` and pipe the response directly into Bash. The downloaded content is neither pinned to a specific release nor validated using a cryptographic signature or checksum before execution. Consequently, the code actually executed can change after the Skill has been reviewed. Compromise of the installer publishing account, origin server, delivery infrastructure, DNS, or TLS trust chain could turn this installation command into an arbitrary-code execution channel. The OOMOL-branded domain does not eliminate this supply-chain risk. Installing the required CLI can be necessary for the declared Leadfeeder integration, and the instructions appropriately make setup conditional on an actual `command not found` failure. However, immediate execution of an unverified network response exceeds the minimum privilege and trust necessary to install that CLI. ### Attack Path 1. The `oo` CLI is absent, and an attempted connector operation fails with `oo: command not found`. 2. A user or agent follows the documented first-time setup procedure. 3. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 4. An attacker who has compromised the script or its delivery path supplies modified shell commands. 5. Bash executes the response immediately, without integrity verification or review. 6. The payload runs with all privileges available to the invoking user and may perform further network or local-system operations. ### Impact Assessment Successful exploitation permits arbitrary command execution with the invoking user's privileges. Depending on those privilege ...[truncated 581 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation pattern. 2. Pin installation instructions to a specific, versioned CLI release. 3. Download the installer or package to disk without executing it: ```bash curl -fL -o oo-installer.sh "https://example.invalid/releases/<version>/install.sh" ``` 4. Publish a cryptographic digest or signed release manifest through a separately protected channel. 5. Verify the signature and pinned digest before execution. 6. Allow users to inspect the downloaded installer before running it. 7. Prefer a trusted package manager or signed native package where available. 8. Run installation without elevated privileges unless the documented installation target strictly requires elevation. 9. Document the expected files, directories, and permissions modified by installation. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote PowerShell Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:65` **Vulnerability Type**: Remote payload retrieval and execution through `Invoke-RestMethod | Invoke-Expression` **Risk Level**: Critical ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup command uses `Invoke-RestMethod` (`irm`) to obtain PowerShell source from a remote URL and sends the response directly to `Invoke-Expression` (`iex`). This executes the downloaded content in the current PowerShell process without version pinning, Authenticode validation, digest verification, or prior inspection. The effective payload is controlled by the content served at execution time and may differ from what existed during this audit. Compromise of the publishing account or any trusted component in the delivery chain could therefore lead to arbitrary PowerShell execution. Installing the CLI is relevant to the Skill's functionality and is presented only as a fallback when the command is unavailable. Nevertheless, direct execution of an unverified response is not the least-risk installation mechanism. ### Attack Path 1. The `oo` CLI is unavailable on a Windows host. 2. A user or agent follows the first-time setup instructions. 3. `Invoke-RestMethod` downloads the current `install.ps1` response. 4. An attacker who controls or compromises the installer or delivery infrastructure substitutes malicious PowerShell content. 5. `Invoke-Expression` immediately evaluates the response in the current session. 6. The payload receives the invoking user's effective privileges and can access local resources and network services available to that user. ### Impact Assessment Successful exploitation allows arbitrary PowerShell execution with the invoking user's privileges. Potential consequences include: - Access to files, user credentials, tokens, and PowerShell-accessible secrets. - Download and execution of additi ...[truncated 520 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `irm | iex` pattern. 2. Publish a versioned installer signed with Authenticode. 3. Download the installer to a local file without evaluating it: ```powershell Invoke-WebRequest -Uri "https://example.invalid/releases/<version>/install.ps1" -OutFile ".\install.ps1" ``` 4. Validate the Authenticode signature and compare a pinned SHA-256 digest obtained from a separately protected release manifest. 5. Reject unsigned, invalidly signed, or digest-mismatched artifacts. 6. Give the user an opportunity to inspect the script before execution. 7. Prefer a signed MSI, MSIX, or trusted package-manager distribution. 8. Avoid administrator elevation unless explicitly required, and clearly document any requested privileges and system changes. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill includes a one-line installer that downloads a remote script and pipes it directly into bash. If the remote host, CDN path, transport, or install script is compromised, an agent or user following these instructions could execute arbitrary code on the local system with the user's privileges.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This markdown file is in scope for vague-trigger review. The phrase "Use this skill for ANY Leadfeeder request" is extremely broad and does not define exclusions or constraints, which can cause the skill to be invoked for casual mentions or tasks where direct use may not be appropriate.

Static analysis

No suspicious patterns detected.