Loops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 1.0.4

Overview

The skill is mostly a coherent Loops connector, but its setup instructions include unverified remote installer commands that should be reviewed before use.

Review the setup path before installing. Use a trusted, verifiable oo CLI installation method instead of automatically running the remote installer pipeline, and require explicit confirmation before any Loops write, event-send, or delete action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62

Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–66
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable code:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from an external URL and immediately execute them using bash or PowerShell's Invoke-Expression. The downloaded content is not pinned to a specific version or cryptographic digest, saved for inspection, or authenticated with a verifiable release signature.

Although the hosting domain is consistent with the declared OOMOL integration, the effective code executed by these commands can change after the Skill has been reviewed. Compromise of the hosting infrastructure, DNS or TLS path, release process, or installer source would consequently provide a direct arbitrary-code-execution channel.

Installing the CLI is relevant to the Skill's functionality when it is absent, but automatic execution of unverified remote code exceeds the minimum privilege and trust required for installation.

Attack Path

1. The oo command is unavailable, and the Agent follows the documented first-time setup procedure.
2. An attacker compromises or otherwise gains control over the remotely served installation script or its delivery chain.
3. The curl | bash or irm | iex pipeline downloads the attacker-controlled content.
4. The shell executes the content immediately, without integrity verification or an opportunity to inspect it.
5. The payload performs arbitrary actions using the permissions of the user or process running the installer.

Impact Assessment

A malicious installer could read or modify files accessible to the executing account, steal locally available credentials, alter shell or ...[truncated 639 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash and irm | iex installation patterns.
2. Prefer an official operating-system package repository or a version-pinned release artifact.
3. Download the installer or binary to a local file without executing it immediately.
4. Verify a vendor-published cryptographic signature or a SHA-256 digest obtained through an independently trusted channel.
5. Display the exact version, source, destination, and requested privileges to the user and obtain explicit approval before installation.
6. Execute the verified installer as a separate step using the least-privileged account possible.
7. Avoid silent privilege elevation and document all files, services, and configuration that the installer may create.
8. If scripted installation remains necessary, pin an immutable release URL and fail closed when signature or digest verification fails.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill instructs users to install software by piping a remotely fetched script directly into bash, which is a well-known unsafe pattern. If the remote host, transport, or install script is compromised, arbitrary code would execute immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use this skill for "ANY Loops request," covering reading, creating, updating, and deleting data without narrowing the contexts or providing exclusions. This is broad enough to match many ordinary requests involving Loops and does not specify boundaries or negative examples.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.