Security audit

NASA

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible NASA data connector, but it broadly redirects NASA-related requests through OOMOL and documents unverified remote installer commands that execute network-fetched scripts.

Install only if you intentionally want NASA requests handled through OOMOL. Avoid running the documented one-line remote installer as-is; prefer a verifiable installation method, review the installer first, and be aware that NASA query payloads will be processed by OOMOL rather than only by NASA.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:81
Finding: Unverified Remote Installer Is Executed Directly by the Shell
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: NASA Requests Are Broadly Redirected Through a Third-Party Connector
Content: View full analysis
" --data '' --json ``` ### Technical Analysis The Skill declares that it should handle “ANY NASA request” and directs the Agent not to call NASA APIs directly. This is broader than the minimum scope necessary to offer an optional OOMOL-backed NASA integration. It changes Agent tool-selection behavior for an entire topic rather than activating only when a user explicitly asks to use OOMOL. Payloads supplied through `--data` are processed by the `oo` CLI and OOMOL connector. This creates an additional external trust boundary between the user and NASA. NASA queries are generally low sensitivity, but payloads may contain user-supplied search terms, dates, object identifiers, or other contextual information. The audited file does not establish that local credentials or raw NASA API tokens are exfiltrated; it specifically states that credentials are injected server-side. The confirmed concern is forced intermediary processing and overbroad routing, not demonstrated credential theft. ### Attack Path 1. A user submits a request involving NASA, without explicitly selecting OOMOL. 2. The broad Skill description causes the Agent to select this Skill for the request. 3. The Agent constructs a JSON payload from the user’s request. 4. The Agent invokes `oo connector run`, transmittin ...[truncated 888 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The skill instructs users to install software by piping a remote script directly into bash, which executes unverified code from the network without review or integrity checking. If the install endpoint, transport path, or hosting account is compromised, this becomes an easy route to arbitrary code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger text is overly broad: "Use this skill for ANY NASA request" can cause the agent to invoke the skill for casual discussion, summarization, or other NASA-related tasks that do not require tool use. This increases the chance of unnecessary external calls, unintended data exposure to the connector, and execution of the skill's operational instructions in contexts where a direct answer would be safer.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.