LinkedIn

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 1.0.4

Overview

The skill is a coherent LinkedIn connector, but its setup instructions include unverified remote installer commands and it can perform public account-changing actions.

Review the installation path before using this skill. Prefer installing the oo CLI from a pinned, verified release or package manager, and only allow LinkedIn write or delete actions after checking the exact payload and target post/account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download mutable scripts from an external server and immediately pass their contents to command interpreters. Neither installation path pins a specific release, verifies a cryptographic signature or checksum, nor saves the script for inspection before execution. The installer source is presented as the CLI vendor's HTTPS domain, and installing the CLI supports the Skill's declared LinkedIn integration. However, HTTPS alone does not establish the integrity of future installer content. The commands create a remote code-execution channel whose effective payload can change after the Skill has been reviewed. This execution mechanism exceeds the minimum privileges necessary to perform LinkedIn connector operations. The connector only requires an installed CLI; it does not inherently require executing unverified, mutable remote content. The downloaded installer runs with all privileges available to the invoking shell. ### Attack Path 1. A LinkedIn action fails because the `oo` CLI is not installed. 2. The Agent or user follows the documented first-time setup instructions. 3. The shell downloads the current response from `cli.oomol.com`. 4. A compromise of the hosting account, release process, domain, or delivered installer causes malicious content to be returned. 5. The pipe sends that content directly to Bash or PowerShell without integrity verification or prior review. 6. The malicious script executes with the invoking user's permissions and can perform arbitrary local actions. ### Impact Assessment ...[truncated 732 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation patterns. 2. Pin installation instructions to a specific, immutable CLI version from the vendor's official release repository. 3. Download the installer or package to a local file rather than piping it directly into an interpreter. 4. Verify the downloaded artifact against a securely published SHA-256 or stronger checksum. 5. Prefer cryptographic signature verification using a trusted, independently distributed signing key. 6. Present the verified script or package to the user and require explicit approval before execution. 7. Prefer a trusted operating-system package manager with version pinning and package-signature validation where available. 8. Run installation with ordinary user privileges unless a narrowly scoped operation explicitly requires elevation. 9. Document the files, commands, network destinations, and privilege changes performed by the installer. A safer workflow is: download a pinned release, verify its checksum and signature, inspect or approve the artifact, and only then execute the local verified file.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs use of a remote install script piped directly into a shell (`curl ... | bash`), which executes unverified code from the network without integrity checking or review. If the remote server, distribution path, or connection is compromised, this can lead to arbitrary code execution on the host running the skill.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The skill description says to use this skill for ANY LinkedIn request, including reading, creating, updating, and deleting data, without narrowing invocation to specific user intent or risk level. That broad trigger surface can cause the agent to select a high-privilege skill in situations where a narrower or read-only path would be safer, increasing the chance of unintended state-changing actions.

Static analysis

No suspicious patterns detected.