Miro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:04 AM UTC
• Version: 1.0.4

Overview

This Miro skill is mostly coherent, but its first-time setup tells users to execute unverified remote install scripts directly, which needs review before installation.

Review the first-time setup carefully before installing. Prefer installing the oo CLI from a pinned, verifiable release or official package source, and only connect Miro through OOMOL if you are comfortable with OOMOL processing request payloads, responses, and authorized Miro operations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62

Finding

Unverified Remote Installation Scripts Are Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:62-71
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code Snippet:

markdown

- **`oo: command not found`** — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  ```

Technical Analysis

Both installation commands download mutable content from an external server and pass it directly to an interpreter. The Bash command pipes the HTTP response into bash, while the PowerShell command passes it to Invoke-Expression through the iex alias.

The instructions do not pin a release version, verify a cryptographic checksum, validate a signature, or provide an opportunity to inspect the downloaded script before execution. Consequently, the effective code executed by the Skill can change after the reviewed SKILL.md file is published.

Installing a required CLI can be legitimate, but immediate execution of unverified network content exceeds the minimum privilege and trust needed for installation. A package or installer obtained from a pinned, authenticated release would accomplish the same purpose with less supply-chain exposure.

Attack Path

1. The oo command is absent, causing the documented first-time setup procedure to be used.
2. An agent or user runs the command supplied by the Skill.
3. The system retrieves the current script from cli.oomol.com.
4. The response is passed directly to Bash or PowerShell without integrity verification.
5. If the hosting infrastructure, publication account, DNS/TLS trust path, or installer itself is compromised, attacker-controlled commands execute under the invoking user's account.

Impact Assessment

A malicious installation response c ...[truncated 648 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash and irm | iex installation patterns.

• Direct users to a version-pinned release from an authenticated official repository or platform package manager.

• Download the installer to a local file without executing it automatically.

• Publish a SHA-256 or stronger checksum over a separately authenticated channel and verify it before execution.

• Sign releases and require signature verification, such as Authenticode verification for Windows artifacts and an appropriate detached signature mechanism for Unix artifacts.

• Display the resolved version and source to the user and require explicit approval before installation.

• Run installation with ordinary user privileges unless a specific installation operation demonstrably requires elevation.

• Prefer instructions equivalent to:

  bash

  curl -fSLo oo-install.sh "https://trusted.example/releases/vX.Y.Z/install.sh"
  echo "EXPECTED_SHA256  oo-install.sh" | sha256sum --check
  less oo-install.sh
  bash oo-install.sh
  

The actual URL, version, and checksum must come from an authenticated official release and must not use an unpinned mutable endpoint.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3

Finding

Mandatory Third-Party Routing Expands Exposure of Miro Data and Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:3-3
Related Locations: SKILL.md:14-14, SKILL.md:28-31
Vulnerability Type: Skill instruction hijacking and unnecessary expansion of the data trust boundary
Risk Level: Medium

Vulnerable Code Snippets:

yaml

description: "Miro (miro.com). Use this skill for ANY Miro request — reading, creating, updating, and deleting data. Whenever a task involves Miro, use this skill instead of calling the API directly."

markdown

Operate **Miro** through your OOMOL-connected account. This skill calls the `miro` connector with the oo CLI; OOMOL injects credentials server-side, so you never handle raw tokens.

bash

oo connector run "miro" --action "<action_name>" --data '<json>' --json

Technical Analysis

The Skill directs the agent to use this integration for every Miro request and explicitly disallows direct API access. This changes tool-selection behavior beyond merely documenting how the Skill works. All request payloads and returned Miro data are therefore routed through the OOMOL CLI and connector infrastructure.

The intermediary is part of the declared connector design, and the file openly states that OOMOL injects credentials server-side. However, it provides no data-minimization requirements, retention assurances, payload sensitivity checks, or requirement for informed consent before Miro content is sent through this additional trust boundary.

The available operations include reading board content and performing write or destructive actions. Although the Skill appropriately requires confirmation for write and destructive operations, the broad “ANY Miro request” instruction is not limited to cases where third-party routing is necessary or explicitly approved.

Attack Path

1. A user makes a request involving Miro.
2. The broad Skill instruction forces the agent to select the OOMOL connector rather than another approved inte ...[truncated 1363 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unconditional “ANY Miro request” and “instead of calling the API directly” language with scoped guidance that allows users or agents to select an approved direct integration.
• Clearly disclose before first use that request payloads, Miro responses, and operation metadata are processed by OOMOL.
• Obtain explicit user consent before transmitting potentially sensitive board content through the third-party connector.
• Document OOMOL's data retention, logging, encryption, subprocess isolation, incident response, and deletion practices.
• Minimize each request to the fields required by the selected action and avoid transmitting unrelated board content.
• Restrict OAuth scopes to those required for the requested operation; do not grant write or deletion scopes for read-only use.
• Separate read-only and write-capable connector profiles where possible.
• Retain the existing explicit confirmation controls for write and destructive actions and include the exact account, board, target object, and resulting effect in each confirmation.
• Permit direct Miro API access through an approved credential mechanism when it reduces third-party exposure and satisfies the user's security policy.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell, which creates a supply-chain and remote-code-execution risk. If the install endpoint, transport, hosting, or published script is compromised, arbitrary code would run immediately on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description says to use this skill for "ANY Miro request" and "Whenever a task involves Miro," which is an extremely broad activation condition. This lacks clear scope boundaries or exclusion examples, increasing the chance of unintended invocation for loosely related mentions of Miro.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.