Loop Returns

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:14 AM UTC
• Version: 1.0.2

Overview

The skill’s Loop Returns connector behavior is mostly coherent, but its setup instructions tell users to run mutable remote installer scripts directly in a shell without verification.

Install only if you are comfortable using OOMOL as an intermediary for Loop Returns access. Before running the setup commands, prefer a signed or package-manager installation path for the oo CLI, verify the source, and avoid running the installer from an elevated shell. Review the connector schema and payload before any action that could affect business return data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Installer Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High The first-time setup instructions execute remotely hosted installation scripts directly: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both installation methods pass network-delivered content directly to a command interpreter. The instructions do not pin an installer version, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded script before execution. Consequently, the effective code executed by this Skill can change after the Skill itself has been audited. HTTPS protects transport but does not guarantee that the hosted installer remains trustworthy. Compromise of the hosting infrastructure, publishing account, DNS or TLS trust chain could turn these commands into an arbitrary-code delivery mechanism. Installing the required CLI may support the declared Loop Returns functionality, but immediate download-to-shell execution is not the minimum privilege or safest installation method. The separate `oo connector` network operations are disclosed and necessary for the connector workflow; the reviewed content did not establish unrelated data exfiltration or direct handling of raw credentials. ### Attack Path 1. The `oo` CLI is absent, causing the agent or user to follow the first-time setup instructions. 2. The command requests a mutable installer from `cli.oomol.com`. 3. The remote service, publishing pipeline, or relevant trust infrastructure is compromised, or the hosted installer is otherwise replaced. 4. `bash` or PowerShell immediately interprets the response without integrity validation or local review. 5. The supplied payload executes with the privileges of the user run ...[truncated 670 chars]
• Remediation: ## Remediation Suggestions - Replace direct `curl | bash` and `irm | iex` execution with a trusted package manager or a version-pinned release artifact. - Download the installer to a local file instead of piping it directly into an interpreter. - Publish and verify a cryptographic signature from a pinned publisher key. At minimum, verify a version-specific SHA-256 digest obtained through a separately protected channel. - Allow the user to inspect the downloaded script and require explicit approval before executing it. - Avoid requesting administrator privileges unless a specific installation step requires them; document the exact files and permissions affected. - Pin the installer URL to an immutable release version rather than a mutable `install.sh` or `install.ps1` endpoint. - Apply equivalent integrity and approval controls to both the Bash and PowerShell installation paths. - Prefer documenting installation as a manual prerequisite rather than allowing the Skill to initiate remote installer execution automatically.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users to install software via `curl ... | bash`, which downloads and immediately executes a remote script without verification. If the host, transport, or distribution pipeline is compromised, this can lead to arbitrary code execution on the user's machine; embedding this in a skill makes the unsafe pattern easier to trigger during operational troubleshooting.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says to use this skill for "ANY Loop Returns request," which is a very broad activation condition and does not define scope boundaries or exclusions. Although it is domain-specific to Loop Returns, the manifest provides no negative examples or constraints for when the skill should not activate, increasing the risk of over-invocation.

Static analysis

No suspicious patterns detected.