LIFX

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:29 AM UTC
• Version: 1.0.2

Overview

The skill is mostly aligned with controlling LIFX lights, but it includes unsafe installer commands and under-labels some light-changing actions as safe reads.

Review this skill before installing. It is intended for LIFX control through OOMOL, but do not run the remote installer pipeline unless you independently trust and verify it. Also treat toggle_power and turn_effects_off as write actions requiring explicit confirmation of the selector and effect.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61
• Finding: Unverified Remote Installation Scripts Are Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 61–65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions pipe content retrieved from external URLs directly into Bash or PowerShell. The downloaded scripts are not pinned to an immutable version, saved for inspection, checked against an expected cryptographic hash, or validated using a trusted digital signature. Consequently, the code ultimately executed can change after the Skill has been reviewed. Compromise of the remote hosting environment, domain, DNS resolution, TLS trust chain, or publication credentials could cause arbitrary attacker-controlled commands to execute. Although the URLs appear related to the declared OOMOL service and installation is only presented as an authentication-error fallback, that does not remove the supply-chain risk. This behavior exceeds the minimum privileges needed for normal LIFX operations: operating lights only requires an already-installed connector client, whereas executing a mutable installer grants the remote script the full privileges of the Agent or user running the shell. ### Attack Path 1. The `oo` command is unavailable, causing the Agent or user to follow the first-time setup instructions. 2. An attacker compromises or gains control over the installation script, its hosting infrastructure, or the network trust path. 3. `curl` or `irm` retrieves the modified script. 4. The shell pipeline immediately passes the response to Bash or PowerShell without inspection or integrity verification. 5. The malicious script executes with the current process user's privileges. ### Impact Assessment Successful exploitation permits arbitra ...[truncated 418 chars]
• Remediation: ## Remediation Suggestions - Remove all `curl | bash` and `irm | iex` installation instructions. - Direct users to a documented package-manager installation or a pinned, immutable release artifact. - Require the installer to be downloaded to disk before execution. - Publish an expected SHA-256 or stronger digest over a trusted, separately secured channel and verify it before execution. - Prefer signed packages or scripts and verify the publisher's signature using a pinned trusted key. - Pin the required CLI version instead of retrieving a mutable latest installer. - Display the exact command and request explicit user authorization before installing software. - Run installation with the least-privileged account possible and do not request administrative privileges unless strictly required.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43
• Finding: State-Changing LIFX Actions Are Incorrectly Classified as Safe Reads## Vulnerability Details **File Location**: `SKILL.md`, lines 43–50 **Vulnerability Type**: Insecure action authorization and safety classification **Risk Level**: Medium ### Vulnerable Code ```markdown - `set_state` — Set power, color, brightness, infrared, or transition duration for LIFX lights matching a selector. [write] - `toggle_power` — Toggle the power state for LIFX lights matching a selector. - `turn_effects_off` — Turn off running LIFX effects for lights matching a selector, optionally powering the lights off. - `validate_color` — Validate a LIFX color string and return the hue, saturation, brightness, and kelvin values LIFX will use. ## Safety - Untagged actions are reads (get / list / search) — safe to run directly. ``` ### Technical Analysis `toggle_power` changes the power state of selected physical lights, and `turn_effects_off` changes effect state and can optionally power lights off. Despite these effects, neither action carries the `[write]` tag. The safety policy states that every untagged action is a read and may be run directly. The missing tags therefore create an authorization-policy mismatch: mutating operations bypass the confirmation requirement applied to correctly tagged write actions. This is especially significant because selectors may address multiple lights and `turn_effects_off` may include an additional power-state change. ### Attack Path 1. A request is interpreted as requiring `toggle_power` or `turn_effects_off`. 2. The Agent checks the action list and observes that the selected action has no `[write]` or `[destructive]` tag. 3. Under the documented safety rule, the Agent treats the operation as a safe read. 4. The Agent constructs and executes an `oo connector run` command without confirming the exact selector, payload, or physical effect. 5. One or more LIFX devices have their power or effect state changed without explicit user approval. ### Impact Assessment Exploit ...[truncated 381 chars]
• Remediation: ## Remediation Suggestions - Add `[write]` to both `toggle_power` and `turn_effects_off`. - Require explicit confirmation of the exact selector, affected devices, requested state change, and optional power-off behavior before execution. - Replace the broad rule that all untagged actions are reads with an explicit allowlist of read-only actions. - Treat unknown, newly added, or unclassified connector actions as state-changing by default. - Fetch and validate the live action schema before confirmation so that optional state-changing fields are included in the user's approval. - For broad selectors, resolve or summarize the affected device set before requesting confirmation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This bypasses integrity verification and gives immediate code execution to whatever the remote server returns; if the host, CDN, DNS, TLS trust chain, or distribution pipeline is compromised, arbitrary code can run on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY LIFX request" and "Whenever a task involves LIFX," which is a very broad activation condition without narrower scope or exclusions. In a manifest file, this can cause unintended invocation for casual mentions of LIFX or tasks where this skill is not actually appropriate.

Static analysis

No suspicious patterns detected.