MailGenius

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:51 AM UTC
• Version: 1.0.2

Overview

The skill’s MailGenius use is coherent, but its setup instructions include unverified remote installer commands that deserve review before installation.

Review the oo CLI installation path before using this skill. Prefer an official versioned installer or package-manager flow with signature or checksum verification, and do not let an agent run the pipe-to-shell setup commands automatically. Normal MailGenius connector actions appear scoped and disclosed once the CLI and account connection are already trusted.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Shell Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis This installation command downloads a mutable shell script from an external server and sends it directly to `bash`. It does not pin the installer to a reviewed version, verify a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded content before execution. The domain is consistent with the declared OOMOL service, and the instructions only recommend installation after an `oo: command not found` error. Nevertheless, trust in the TLS endpoint alone does not establish the integrity of the script over time. Compromise of the distribution server, DNS or hosting infrastructure, publication pipeline, or vendor account could alter the effective payload after this Skill has been reviewed. Executing a remote script is not the minimum privilege necessary to document CLI installation. A version-pinned package or a separately downloaded and verified artifact would reduce the supply-chain and arbitrary-code-execution risk. ### Attack Path 1. The `oo` CLI is unavailable, causing the documented first-time setup path to be used. 2. An attacker compromises the remote installer, its publication pipeline, or infrastructure serving `cli.oomol.com`. 3. The installer response is modified to contain attacker-controlled shell commands. 4. The user or agent runs the documented `curl | bash` command. 5. `bash` immediately executes the unverified response under the invoking account. 6. The payload can access, modify, or transmit resources available to that account and may attempt persistence or further privilege escalation. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of ...[truncated 538 chars]
• Remediation: ## Remediation Suggestions - Replace the pipe-to-shell command with installation through a trusted operating-system package manager or an official, version-pinned release artifact. - Download the installer to a local file instead of executing the network response directly. - Publish a SHA-256 or stronger digest through an independently protected channel and verify it before execution. - Prefer signed release artifacts and validate the publisher signature against a pinned, documented public key. - Allow the user to inspect the downloaded script before running it. - Require explicit user approval before installing software or executing any installer. - Run installation with ordinary user privileges unless elevated privileges are demonstrably required. - Document the exact version being installed and provide a reproducible rollback or uninstall procedure. A safer conceptual workflow is: ```bash curl -fSLo install.sh https://cli.oomol.com/releases/<pinned-version>/install.sh echo '<trusted-sha256> install.sh' | sha256sum -c - less install.sh bash install.sh ``` The version and digest must come from a trusted release record rather than being dynamically retrieved from the same potentially compromised endpoint.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote PowerShell Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` retrieves PowerShell source code from an external URL, and `iex` evaluates the returned text immediately in the current PowerShell process. The command performs no version pinning, Authenticode validation, cryptographic digest verification, or manual inspection. Consequently, the code that eventually executes can change after review of this Skill. Although the URL belongs to the vendor associated with the declared CLI and the setup path is conditional, compromise of the remote host, publishing account, release pipeline, or related infrastructure would turn this instruction into an arbitrary-code-execution channel. This behavior exceeds the minimum privilege needed to provide setup guidance. A signed, versioned installer downloaded and verified before execution would support the same declared functionality with a smaller trust boundary. ### Attack Path 1. A Windows user encounters an unavailable `oo` command and follows the first-time setup instructions. 2. An attacker gains control over the installer response or the infrastructure used to publish it. 3. The attacker inserts arbitrary PowerShell commands into `install.ps1`. 4. `Invoke-RestMethod` retrieves the malicious response. 5. `Invoke-Expression` executes the response without integrity or signature verification. 6. The malicious commands operate with the current PowerShell process's privileges and can download further payloads, access user data, alter configuration, or attempt persistence and privilege escalation. ### Impact Assessment Exploitation enables arbitrary PowerShell execution as the invoking user. The attacker could read or alter user-accessible files, ...[truncated 458 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `irm | iex` installation pattern. - Link to a specific, immutable CLI release and download the installer as a file. - Require a valid Authenticode signature from the expected publisher before execution. - Publish and verify a cryptographic digest through an independently protected release channel. - Display the resolved artifact version and request explicit user approval before running it. - Avoid administrative PowerShell sessions unless installation genuinely requires system-wide changes. - Prefer a signed MSI, Microsoft Store package, Windows Package Manager package, or another versioned package-distribution mechanism with publisher verification. - Document rollback and uninstall procedures. A safer conceptual workflow is: ```powershell Invoke-WebRequest 'https://cli.oomol.com/releases/<pinned-version>/install.ps1' -OutFile '.\install.ps1' Get-FileHash '.\install.ps1' -Algorithm SHA256 Get-AuthenticodeSignature '.\install.ps1' Get-Content '.\install.ps1' .\install.ps1 ``` Execution should proceed only if the digest matches a trusted release record and the signature is valid and belongs to the expected publisher.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent/user to install the CLI by piping a remotely fetched script directly into `bash`, which is a classic supply-chain and remote code execution risk. If the install endpoint, transport, or upstream release process is compromised, arbitrary code would execute immediately on the host running the skill, and the skill context makes this more dangerous because it explicitly presents the command as a recovery step for normal operation.

Static analysis

No suspicious patterns detected.