Mattermost

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:40 AM UTC
• Version: 1.0.3

Overview

This Mattermost skill is mostly coherent, but its first-time setup tells users or agents to run remote installer scripts directly in a shell without verification.

Review this before installing. The Mattermost actions themselves are disclosed and mostly bounded, but use a safer verified installation method for the oo CLI instead of piping remote scripts directly into a shell, and confirm any post-creation payload before allowing it to run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Installer Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57-65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download mutable scripts from external URLs and immediately execute them using `bash` or PowerShell's `Invoke-Expression`. There is no separate review step, pinned release, cryptographic checksum, or signature verification. HTTPS protects the scripts while in transit, but it does not establish that their contents are safe or immutable. Compromise of the hosting service, publisher account, DNS or deployment infrastructure—or an unintended modification by the publisher—could alter the code executed after this Skill has already been reviewed. The installer payloads are not included in the audited project, so their behavior cannot be statically assessed. Installing a CLI is relevant to the Skill's declared functionality, but granting an unaudited, remotely mutable response immediate shell execution exceeds the minimum privilege necessary to perform installation. The Linux/macOS and Windows instructions expose the same underlying weakness. ### Attack Path 1. The `oo` CLI is unavailable and a command fails with `oo: command not found`. 2. The agent or user follows the first-time setup instructions in `SKILL.md`. 3. `curl` or `Invoke-RestMethod` retrieves a script from OOMOL's mutable remote endpoint. 4. The response body is passed directly to `bash` or `Invoke-Expression` without inspection or integrity verification. 5. If the endpoint or its publishing infrastructure has been compromised, attacker-controlled commands ...[truncated 959 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct download-to-shell pipelines. 2. Pin installation to a specific, reviewed `oo` CLI release and immutable artifact. 3. Download the installer or binary to a local file without executing it automatically. 4. Verify the downloaded artifact using a cryptographic signature or a SHA-256 checksum obtained through an independently authenticated release channel. 5. Fail closed if integrity or signature verification is unavailable or unsuccessful. 6. Prefer a trusted platform package manager with version pinning and package-signature validation where available. 7. Display the exact artifact source, version, checksum, and commands before installation. 8. Require explicit user approval before running installation commands. 9. Execute installation with ordinary user privileges unless elevated permissions are strictly necessary. 10. If scripts must be used, publish immutable versioned scripts and provide commands resembling: ```bash curl -fSLo oo-install.sh "https://trusted.example/releases/vX.Y.Z/install.sh" echo "<EXPECTED_SHA256> oo-install.sh" | sha256sum --check - bash oo-install.sh ``` For Windows, download to a file, validate its Authenticode signature or published cryptographic hash, and invoke the verified file without using `iex` on a network response. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

- `create_post` — Create a Mattermost post in a channel. [write]
- `get_channel` — Retrieve one Mattermost channel by ID.
- `get_current_user` — Get the Mattermost user associated with the Personal Access Token.
- `get_team` — Retrieve one Mattermost team by ID.
- `list_channel_posts` — List Mattermost posts in a channel.
- `list_team_channels` — List public Mattermost channels in a team.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell, which executes unreviewed code fetched at runtime. If the install endpoint, transport, upstream infrastructure, or distribution process is compromised, this can lead to arbitrary code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This markdown/manifest content defines invocation scope in very broad terms without clear boundaries or exclusion conditions. The phrasing could cause unintended activation for any mention of Mattermost, rather than a narrowly defined set of supported tasks.

Static analysis

No suspicious patterns detected.