Mezmo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.0.3

Overview

The skill is service-focused and not deceptive, but it gives the agent broad OOMOL CLI authority and includes unverified remote installer commands.

Review before installing. This skill is mainly for reading Mezmo usage and ingestion data, but you should only run the oo CLI installer from a source you trust, prefer a verified package or checksum, and keep agent execution limited to the documented Mezmo read actions where possible.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions pipe scripts retrieved from remote URLs directly into Bash or PowerShell. The effective code is not included in the audited project and can change at any time after review. No fixed version, cryptographic checksum, digital signature, or manual inspection step is required before execution. HTTPS provides transport protection but does not establish that the downloaded script is immutable or safe. Compromise of the remote host, publishing account, delivery infrastructure, or certificate trust chain could cause arbitrary attacker-controlled code to execute. This installation behavior is not required for ordinary Mezmo read operations and is only presented as a fallback when the `oo` command is unavailable. ### Attack Path 1. The `oo` CLI is absent, causing an `oo: command not found` failure. 2. The Skill follows its first-time setup instructions. 3. A script is downloaded from `cli.oomol.com`. 4. The response is passed directly to Bash or PowerShell without integrity verification. 5. If the remote source or delivery chain has been compromised, attacker-controlled commands execute with the privileges of the user running the installer. 6. Those commands could access user-readable files, modify the local environment, install additional software, or establish persistence outside the reviewed Skill. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking user's account. The accessible scope includes files, credentials, environment variables, network resources, and system setting ...[truncated 287 chars]
• Remediation: ## Remediation Suggestions - Remove all direct pipe-to-shell installation commands. - Pin installation to a specific, immutable CLI release and version. - Download the installer or binary to a local file before execution. - Verify a publisher-provided cryptographic signature or a checksum obtained through an independent trusted channel. - Prefer a signed operating-system package manager or an official release artifact with provenance metadata. - Present the resolved download URL, version, expected digest, and requested privileges before installation. - Require explicit user approval before installing software. - Run installation with ordinary user privileges unless elevation is strictly required and separately approved. - Document how users can inspect the downloaded artifact before running it.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5
• Finding: Overly Broad oo CLI Command Authorization## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Excessive tool permissions and insufficient command scoping **Risk Level**: Medium **Vulnerable Code**: ```yaml allowed-tools: [Bash(oo *)] ``` ### Technical Analysis The Skill authorizes every command and argument accepted by the `oo` CLI through the `oo *` wildcard. Its declared operational purpose is narrower: inspecting the Mezmo connector schema and invoking five documented read-only Mezmo actions. This broad authorization exceeds the minimum privileges needed for the stated functionality. It does not constrain execution to the `mezmo` connector, the documented read actions, or schema inspection. The file also references authentication and account-management commands, demonstrating that the CLI has capabilities beyond the required read operations. The reviewed project does not contain a demonstrated injection vector or an explicit instruction to abuse unrelated commands. Nevertheless, the wildcard expands the effect of prompt manipulation, malformed input, or command-construction mistakes by allowing any available `oo` subcommand rather than enforcing the Skill's declared boundary. ### Attack Path 1. The Skill is loaded with permission to execute any command matching `oo *`. 2. Attacker-controlled task content, indirect prompt content, or an implementation error influences command selection or arguments. 3. Instead of one of the documented Mezmo read operations, the agent constructs another valid `oo` command or targets an unrelated connector or action. 4. The broad wildcard authorization permits execution because it validates only the executable prefix. 5. The unintended command operates with the current user's OOMOL session and any server-side permissions associated with that account. ### Impact Assessment The attainable scope depends on the commands exposed by the installed `oo` CLI and the permissions of the authenticate ...[truncated 387 chars]
• Remediation: ## Remediation Suggestions - Replace `Bash(oo *)` with narrowly scoped permissions for the exact required command forms. - Restrict connector operations to the `mezmo` connector. - Enforce an allowlist containing only `get_ingestion_status`, `get_usage_summary`, `list_app_usages`, `list_host_usages`, and `list_tag_usages`. - Permit schema inspection only for those approved actions. - Reject unexpected subcommands, connector names, action names, flags, and positional arguments before execution. - Construct commands using structured arguments rather than concatenating untrusted text into shell command strings. - Keep authentication, installation, billing, and connection-management operations outside routine Skill permissions and require explicit user initiation. - Apply server-side authorization so the account or connector token can perform only the documented read operations.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software via `curl ... | bash`, which executes a remote script without verification, pinning, or integrity checks. If the remote host, transport, or distribution path is compromised, arbitrary code could run on the user's system under the current user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Mezmo request" and "Whenever a task involves Mezmo," which is extremely broad and lacks constraints or exclusion examples. This can overlap with many ordinary mentions of Mezmo and does not clearly define when the skill should or should not activate.

Static analysis

No suspicious patterns detected.