NetSuite

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:29 AM UTC
• Version: 1.0.2

Overview

The skill’s NetSuite behavior is mostly clear, but its setup instructions tell users to run remote installer scripts directly, which creates unnecessary local execution risk.

Before installing, review the oo CLI installation source and prefer a verified, version-pinned installer or package-manager flow. Use the skill only with a NetSuite account where the agent is allowed to read and change the relevant records, and require confirmation for every create or update action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Shell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md:59` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely downloaded shell script directly into Bash. The effective code is controlled by the remote server and can change after the Skill has been reviewed. The instruction does not pin a release, verify a checksum or cryptographic signature, or provide an opportunity to inspect the script before execution. HTTPS protects data in transit but does not protect against compromise of the publishing infrastructure, malicious replacement of the hosted installer, or misuse of the vendor's deployment credentials. Because the script executes as the invoking user, it can perform any operation available to that account. ### Attack Path 1. The `oo` command is unavailable, causing the documented first-time setup path to be used. 2. An attacker compromises the installer host, its publishing pipeline, or credentials capable of modifying `install.sh`. 3. The user or agent runs the documented `curl | bash` command. 4. `curl` downloads the current attacker-controlled response without validating a pinned digest or signature. 5. Bash immediately executes the response with the invoking user's privileges. 6. The payload can modify files, execute additional programs, access user-readable credentials, or establish persistence within the account's permission boundary. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installer. This may expose local files, environment variables, application credentials, and NetSuite-related business data accessible to that account. The payload may also modify user configuration or install persistent components. If the command is run by an administrator, th ...[truncated 46 chars]
• Remediation: ## Remediation Suggestions - Replace the pipe-to-shell command with a version-pinned package or release artifact from the official distribution channel. - Download the artifact to a local file without executing it automatically. - Publish and require verification of a cryptographic signature or a checksum obtained through an independently authenticated channel. - Display the resolved version, source URL, and requested installation scope before execution. - Require explicit user approval before installing software or making system changes. - Run installation with ordinary user privileges unless elevated access is strictly required. - Prefer a trusted operating-system package manager with package signing and reproducible version selection. - If a script remains necessary, document a safer sequence such as download, signature verification, inspection, and explicit execution as separate steps.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote PowerShell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md:63` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). No version pinning, signature validation, checksum verification, or local review occurs before execution. This pattern converts control of the remote response into arbitrary PowerShell execution. The payload remains changeable after audit and inherits the invoking PowerShell process's permissions. Use of HTTPS alone does not establish that the hosted script is the specific artifact that was reviewed and approved. ### Attack Path 1. The `oo` command is unavailable on a Windows system, triggering the documented setup procedure. 2. An attacker gains control of the hosted `install.ps1` response through compromise of the distribution host, publishing pipeline, or deployment credentials. 3. The user or agent runs the documented `irm ... | iex` command. 4. PowerShell retrieves the current remote content without checking a pinned hash or trusted code-signing signature. 5. `Invoke-Expression` evaluates the content immediately in the current PowerShell context. 6. The payload can read accessible data, execute programs, alter user settings, download further components, or create persistence within the invoking account's permissions. ### Impact Assessment Successful exploitation grants arbitrary PowerShell execution with the current user's privileges. Accessible files, environment variables, browser or application data, and locally available credentials may be exposed or altered. User-level persistence may be established, and execution from an elevated PowerShell session could result in system-wide compromise.
• Remediation: ## Remediation Suggestions - Do not pipe remote content into `Invoke-Expression`. - Distribute a versioned, Authenticode-signed PowerShell script or signed package through an official release channel. - Download the artifact separately and verify its signer and a pinned cryptographic digest before execution. - Fail closed if signature or checksum validation is unavailable or unsuccessful. - Require explicit user approval after showing the artifact version, publisher, source, and intended changes. - Use standard user privileges by default and request elevation only for narrowly defined operations that require it. - Prefer a trusted Windows package manager that validates publisher identity and supports exact version selection.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This creates a supply-chain and remote code execution risk: if the remote server, transport, or script content is compromised, arbitrary commands could run on the host without inspection.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Line L03 says to use this skill for "ANY NetSuite request" and "Whenever a task involves NetSuite," which is very broad and could match a wide range of ordinary requests without clear boundaries. The file does not provide negative examples or narrower scope constraints to clarify when the skill should not activate.

Static analysis

No suspicious patterns detected.