Mingdao

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:43 AM UTC
• Version: 1.0.0

Overview

This Mingdao connector is mostly purpose-aligned, but its first-time setup tells users or agents to execute remote installer scripts directly, which needs manual review before installation.

Install only if you trust OOMOL and are comfortable with the connector modifying Mingdao data. Do not run the curl-to-bash or irm-to-iex setup commands blindly; prefer a verified package, pinned release, checksum or signature check, and user approval before any installer runs. Review payloads carefully before approving write or destructive Mingdao actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:101
• Finding: Unverified Remote Shell Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 101 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a mutable script from an external URL and pipes it directly into Bash. The script is executed without pinning a release version, validating a cryptographic signature or checksum, or providing an opportunity to inspect the downloaded content. HTTPS protects the connection in transit but does not establish that the hosted script is immutable or independently verify the artifact's integrity. If the hosting infrastructure, publishing account, DNS resolution, or TLS trust chain is compromised, the returned content could be replaced after the Skill has already passed review. Although this command appears only in conditional first-time setup instructions, the reduced execution frequency does not eliminate the arbitrary-code execution risk. ### Attack Path 1. The `oo` CLI is absent, causing the agent or user to follow the first-time setup instructions. 2. The command requests `https://cli.oomol.com/install.sh`. 3. An attacker who controls or compromises the distribution endpoint, publishing process, DNS path, or trusted delivery infrastructure substitutes a malicious script. 4. `curl` sends the response body directly to Bash without local verification. 5. Bash executes the substituted payload with the permissions of the invoking user. 6. The payload may read accessible files and credentials, alter user configuration, install additional software, or establish persistence. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The attacker could access any files, environment variables, credentials, and network resources available to that user. If installation is perfo ...[truncated 376 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` execution pipeline. 2. Prefer installation through a reviewed operating-system package manager or a signed, version-pinned release. 3. If a standalone installer is necessary: - Download it to a local file without executing it. - Pin an explicit CLI and installer version. - Verify a vendor-published cryptographic signature or pinned SHA-256 digest. - Abort installation if verification fails. - Execute the verified local file only after explicit user approval. 4. Publish integrity metadata through an independently protected channel. 5. Avoid automatic installation by an agent; direct the user to complete and approve the installation separately. 6. Run the installer with the minimum required privileges and clearly warn users not to invoke it as root unless strictly necessary. A safer conceptual workflow is: ```bash curl -fL -o install.sh "https://cli.oomol.com/releases/<PINNED_VERSION>/install.sh" printf '%s %s\n' '<PINNED_SHA256>' 'install.sh' | sha256sum --check - bash install.sh ``` The digest and URL must refer to a fixed, reviewed release rather than a mutable endpoint. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:105
• Finding: Unverified Remote PowerShell Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 105 **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: Critical ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This command retrieves a mutable PowerShell script from an external endpoint with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). No release version is pinned, and no Authenticode signature, cryptographic digest, or other independent integrity control is checked before execution. `Invoke-Expression` interprets the response as executable PowerShell code. Consequently, any content supplied by a compromised distribution endpoint or delivery chain gains direct code-execution capability. Because the payload remains remote and mutable, its behavior can change after the Skill package has been audited. The command is limited to first-time setup when the CLI is missing, but this condition only reduces how often the vulnerable path is reached. ### Attack Path 1. The `oo` CLI is unavailable on a Windows host. 2. The agent or user follows the documented first-time setup command. 3. An attacker compromises or controls the installer endpoint, publishing account, DNS resolution, or trusted delivery infrastructure. 4. `Invoke-RestMethod` retrieves attacker-controlled PowerShell content. 5. The pipeline passes that content directly to `Invoke-Expression`. 6. PowerShell executes the payload with the current process token. 7. The payload may collect accessible credentials, modify user or system configuration, download additional components, or create persistence. ### Impact Assessment Exploitation results in arbitrary PowerShell execution with the privileges and access token of the invoking user. A standard user context permits access to that user's data, credentials, configuration, and authorized network resources ...[truncated 324 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `irm | iex` pipeline and never evaluate network responses directly. 2. Use a signed, version-pinned installer distributed through a trusted package manager when possible. 3. Otherwise, download the installer to a local file and verify it before execution: - Pin an immutable release URL and expected version. - Validate an independently published SHA-256 digest. - Validate the Authenticode signature and expected signer certificate. - Reject unsigned, invalidly signed, or unexpected artifacts. - Obtain explicit user approval before running the verified script. 4. Execute the installer with the minimum required privileges. 5. Document the expected publisher identity and verification procedure. 6. Keep installation separate from routine connector operations so a Skill invocation cannot silently install software. A safer conceptual workflow is: ```powershell Invoke-WebRequest ` -Uri "https://cli.oomol.com/releases/<PINNED_VERSION>/install.ps1" ` -OutFile ".\install.ps1" if ((Get-FileHash ".\install.ps1" -Algorithm SHA256).Hash -ne "<PINNED_SHA256>") { throw "Installer integrity verification failed." } $signature = Get-AuthenticodeSignature ".\install.ps1" if ($signature.Status -ne "Valid") { throw "Installer signature verification failed." } .\install.ps1 ``` The expected digest, signer, and URL must identify a fixed, reviewed release and must be maintained through a trusted release process. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software by piping a remote script directly into bash, which executes unverified code from the network without integrity checking or review. If the install endpoint, transport, or upstream distribution is compromised, this can lead to arbitrary code execution on the host running the skill workflow.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger text says to use this skill for ANY Mingdao request, which makes routing overly broad and can cause the agent to invoke a powerful connector by default even when a narrower or safer path would suffice. In context, this skill exposes many write and destructive actions, so broad auto-selection increases the chance of unintended data modification or deletion from loosely related user prompts.

Static analysis

No suspicious patterns detected.