LiveAgent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:11 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for managing LiveAgent through OOMOL, but its setup instructions include unverified remote installer scripts that run directly in a shell.

Before installing, review the oo CLI setup path carefully. Prefer an official package manager, pinned release, or verified download instead of running curl | bash or irm | iex, and only allow write actions after checking the exact LiveAgent payload and effect.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote Installer Scripts Executed Directly by Shell Interpreters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–70 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately pass their contents to Bash or PowerShell. Neither command pins a specific installer version nor verifies a cryptographic signature or checksum before execution. Although installing the `oo` CLI supports the Skill's declared functionality and the download domain is consistent with the named provider, direct pipe-to-interpreter installation exceeds the minimum privileges necessary. Downloading an artifact, verifying its integrity, and obtaining approval before execution would accomplish the same purpose with substantially less supply-chain risk. Because the effective scripts are hosted remotely, their contents can change after this Skill has been reviewed. Compromise of the hosting service, installer publishing pipeline, domain, or relevant network trust path could therefore convert the documented setup procedure into an arbitrary-code-execution channel. The separate connector network behavior is disclosed and necessary to operate LiveAgent through OOMOL. The audited file contains no evidence that it reads raw credentials or covertly transmits sensitive information to an unrelated service. ### Attack Path 1. The user attempts to use the Skill on a system where the `oo` CLI is unavailable. 2. The command fails with `oo: command not found`, causing the first-time setup instructions to apply. 3. An attacker compromises or gains control over the remote installer content or its publication infrastructure. 4. The user or agent runs the documented `curl | bash` or `irm | iex` command. 5. T ...[truncated 958 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation patterns. 2. Direct users to a trusted package manager or an official, versioned release repository. 3. Pin the installer or package to an explicit release version. 4. Download the installer to a local file instead of executing the network response directly. 5. Publish and verify a SHA-256 checksum or, preferably, a cryptographic signature using a separately distributed trusted key. 6. Fail closed if signature or checksum verification does not succeed. 7. Allow the user to inspect the downloaded artifact and require explicit approval before executing it. 8. Run installation with ordinary user privileges wherever possible and request elevation only for specific, documented operations that require it. 9. Document the expected files, directories, subprocesses, and network endpoints used by the installer. 10. For automated environments, use a reviewed and immutable installer artifact rather than a mutable URL. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to install software via a remote script piped directly into a shell (`curl ... | bash`), and similarly via `iex` in PowerShell. This creates a code-execution path from network-fetched content without integrity verification, so if the remote host, transport, or distribution pipeline is compromised, arbitrary code could run on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description says to use this skill for ANY LiveAgent request and instead of calling the API directly, which is an overly broad routing instruction. Broad triggers can cause the agent to invoke this skill in situations where a narrower, safer, or more context-appropriate path should be chosen, increasing the chance of unintended actions or unnecessary exposure to powerful write capabilities.

Static analysis

No suspicious patterns detected.