MSG91

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:01 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for MSG91 operations, but it includes unsafe first-time installer commands and misclassifies OTP resending as a safe read-like action.

Review before installing. Use this only if you are comfortable with OOMOL-mediated MSG91 access, and do not run the remote installer pipeline without independently verifying the installer source. Treat resend_otp as a write action and confirm the recipient, channel, and intended effect before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md:58-62` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions pipe remotely downloaded content directly into Bash or PowerShell. The effective code is retrieved at execution time and can change after the Skill has been reviewed. Neither command pins a specific release nor verifies a cryptographic signature or checksum before execution. HTTPS protects data in transit but does not establish that the current remote payload is the same payload that was originally reviewed. Compromise of the hosting service, DNS infrastructure, CDN, TLS endpoint, or publisher account could allow an attacker to replace the installer. The replaced response would be executed immediately with the privileges of the user running the command. This installation behavior exceeds the minimum privileges needed for ordinary MSG91 actions. The declared functionality only requires invoking an already installed `oo` CLI and submitting requests through the connector; it does not inherently require executing mutable remote scripts. ### Attack Path 1. An attacker compromises or gains control over the installer endpoint or its publishing infrastructure. 2. The attacker replaces `install.sh` or `install.ps1` with a malicious payload. 3. The `oo` command is unavailable, causing the user or agent to follow the first-time setup instructions. 4. The shell pipeline downloads the attacker-controlled response. 5. Bash or PowerShell executes the response immediately, without integrity verification or an inspection step. 6. The payload performs arbitrary operations under the invoking user's account. ### Impact Assessment Succe ...[truncated 405 chars]
• Remediation: ## Remediation Suggestions 1. Remove all direct `curl | bash` and `irm | iex` installation instructions. 2. Prefer installation through a trusted operating-system package manager using a pinned package version. 3. If direct artifact installation is necessary, download the artifact to a local file without executing it. 4. Pin the artifact to a specific reviewed release rather than a mutable generic installer URL. 5. Publish and verify a cryptographic checksum and, preferably, a signature from a separately secured channel. 6. Display the artifact path, expected digest, signer identity, and intended changes before requesting user approval. 7. Execute the verified installer without elevated privileges unless a documented installation step strictly requires elevation. 8. Keep installation separate from normal connector operation and require explicit user approval before initiating it.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39
• Finding: OTP Resend Action Incorrectly Classified as a Safe Read## Vulnerability Details **File Location**: `SKILL.md:39-48` **Vulnerability Type**: Unsafe action classification and missing confirmation control **Risk Level**: Medium ### Vulnerable Code ```markdown - `resend_otp` — Resend an existing MSG91 OTP by text message or voice call. - `send_flow_sms` — Send an SMS through an approved MSG91 Flow template. [write] - `send_otp` — Generate or send an OTP with an MSG91 OTP template. [write] - `verify_otp` — Verify an OTP previously sent through MSG91. ## Safety - Untagged actions are reads (get / list / search) — safe to run directly. - **Actions tagged `[write]` change MSG91 state — confirm the exact payload and effect with the user before running.** ``` ### Technical Analysis The `resend_otp` action is untagged even though its documented purpose is to send a text message or initiate a voice call. The safety policy states that every untagged action is a read and may therefore be run directly without confirmation. Resending an OTP is externally observable, can incur charges, and affects a third party. It is consequently a write or side-effecting action rather than a read. The mismatch permits an agent following the Skill instructions to invoke the action without confirming the destination, delivery channel, cost, or intended effect. Although no direct privilege escalation is demonstrated, this weak action classification breaks the Skill's stated approval boundary and grants the agent more operational discretion than is necessary for the declared task. ### Attack Path 1. A request is interpreted as requiring the `resend_otp` action. 2. The agent checks the action list and finds no `[write]` or `[destructive]` tag. 3. The general safety rule classifies the untagged action as a safe read. 4. The agent submits a payload without obtaining explicit confirmation of the recipient and delivery method. 5. MSG91 sends an OTP by SMS or places a voice call. 6. Repeated or inco ...[truncated 497 chars]
• Remediation: ## Remediation Suggestions 1. Mark `resend_otp` explicitly as `[write]`. 2. Require explicit user confirmation immediately before execution. 3. Present the recipient, masked phone number where appropriate, delivery channel, template or OTP context, expected cost, and external effect during confirmation. 4. Replace the assumption that every untagged action is a read with an explicit safety classification for each action. 5. Treat all actions that send communications, trigger calls, consume credits, or modify remote state as side-effecting operations. 6. Add retry and rate controls to prevent accidental repeated delivery. 7. Avoid displaying or logging complete OTP values or unnecessary recipient information in command output.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill includes a classic remote-script execution pattern: piping a downloaded installer directly into a shell. If the install endpoint, transport path, or hosting account is compromised, the agent or user could execute arbitrary code with the current user's privileges, turning a setup step into full system compromise.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY MSG91 request" and whenever a task involves MSG91, which is very broad and does not define clear boundaries or exclusions. This can cause unintended invocation for loosely related mentions of MSG91 because no negative examples or scope constraints are provided.

Static analysis

No suspicious patterns detected.