Miro

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:49 PM UTC
• Version: 1.0.2

Overview

The skill is a coherent Miro integration, but its first-time setup tells users to execute unverified remote installer scripts.

Review the installer path before installing. Prefer a pinned, signed, or package-manager-based oo CLI installation, and do not run the documented remote script commands from an elevated shell. For Miro writes or deletions, confirm the board, item, and payload before allowing the action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote Shell Script Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md:66` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely downloaded script directly into Bash. The script is neither version-pinned nor verified using a cryptographic signature or published checksum. Its effective contents can therefore change after the Skill has been reviewed. Although installing the `oo` CLI supports the declared Miro integration and the URL uses an OOMOL domain, immediate network-to-shell execution exceeds the minimum privileges necessary for installation. Separately downloading and verifying a fixed release would provide the same functionality without implicitly trusting mutable remote content. A compromise of the installer host, its deployment process, or the relevant network trust chain could turn this documented installation path into arbitrary local code execution. ### Attack Path 1. The `oo` command is unavailable, causing the agent or user to follow the first-time setup instructions. 2. An attacker compromises or replaces the payload served by `https://cli.oomol.com/install.sh`, or otherwise compromises the delivery chain. 3. `curl` retrieves the modified script without pinning or integrity verification. 4. The pipe sends the response directly to Bash without an opportunity for inspection. 5. The attacker-controlled script executes with all privileges available to the invoking user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the account that runs the installer. This may allow access to that account's files, authentication material, environment variables, active sessions, and locally accessible services. The payload could modify user configuration, install persistence, or invoke network services. I ...[truncated 241 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Direct users to a version-pinned release artifact or a trusted platform package manager. - Download the installer to a local file before execution so it can be inspected. - Publish and require verification of a cryptographic signature or checksum over the downloaded artifact. - Pin the expected release version rather than relying on a mutable `install.sh` endpoint. - Run installation with ordinary user privileges unless a documented operation specifically requires elevation. - Prefer instructions similar to: download artifact, verify signature and checksum, inspect permissions, and then execute the verified local file.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:70
• Finding: Unverified Remote PowerShell Script Execution on Windows## Vulnerability Details **File Location**: `SKILL.md:70` **Vulnerability Type**: Remote payload retrieval and immediate PowerShell execution **Risk Level**: High ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). No release version, signature, certificate identity, or cryptographic checksum is pinned or validated before execution. `Invoke-Expression` treats the downloaded response as executable PowerShell code. Consequently, any attacker who can control the delivered response can execute arbitrary commands in the invoking PowerShell session. The trusted-looking command and HTTPS URL do not independently establish the integrity of the script's contents. The installation is related to the Skill's declared functionality, but executing an unreviewed remote response is not the least-privilege or least-trust method of installing the CLI. ### Attack Path 1. The `oo` command is unavailable on a Windows system. 2. The agent or user follows the documented first-time setup command. 3. An attacker compromises the installer endpoint or its software delivery chain. 4. `irm` downloads the attacker-controlled PowerShell response. 5. The pipeline passes the response directly to `iex`. 6. The malicious commands execute with the permissions and accessible credentials of the current PowerShell process. ### Impact Assessment Exploitation permits arbitrary code execution as the invoking Windows user. The payload could read or modify user-accessible files, access environment variables and authentication material, alter PowerShell profiles, communicate with remote services, or establish user-level persistence. If PowerShell is running in an elevated administrative session, the same command could affect s ...[truncated 176 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern and do not evaluate network responses directly. - Provide a version-pinned, signed installer from a verifiable official release location. - Download the installer to disk and validate its Authenticode signature and a separately published cryptographic checksum before execution. - Display the verified local script or package path to the user and require explicit approval before running it. - Use a trusted Windows package manager where the package identity and integrity are independently validated. - Avoid administrative execution unless a narrowly defined installation step demonstrably requires it.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description says to use this skill for ANY Miro request and instead of calling the API directly, which creates a very broad routing trigger. In an agent setting, this can cause automatic invocation for loosely related Miro mentions and may lead to unintended access to connected Miro data or accidental state-changing operations if higher-level safeguards fail.

Static analysis

No suspicious patterns detected.