NeverBounce

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for NeverBounce use, but its setup instructions tell users to run mutable remote installer scripts directly in a shell.

Install only if you are comfortable with OOMOL's oo CLI and NeverBounce connector model. Prefer installing the oo CLI through a verified package or pinned release with checksum/signature validation instead of running the provided remote installer one-liners, and confirm all write actions before they run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62

Finding

Unverified Remote Installers Executed Directly by Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from cli.oomol.com and immediately pass their contents to a command interpreter. Neither command pins an installer version, validates a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded content before execution.

Although installing the oo CLI supports the Skill's declared functionality, executing unverified network content directly is not the minimum safe installation mechanism. The effective code can change after the Skill has been audited. Compromise of the hosting server, DNS or TLS delivery chain, publishing credentials, or installer generation process could therefore turn these documented setup commands into an arbitrary-code-execution channel.

The Windows command has the same security property as the Unix command: Invoke-RestMethod retrieves the script and Invoke-Expression executes it directly in the active PowerShell session.

No evidence in the reviewed file establishes that the currently hosted installers are malicious. The confirmed vulnerability is the unsafe remote execution mechanism and its dependence on mutable, externally hosted content.

Attack Path

1. The oo command is unavailable, causing the user or agent to follow the first-time setup instructions.
2. An attacker compromises the installer host, publishing process, delivery infrastructure, or another mechanism capable of controlling the response from the documented URL.
3. The attacker replaces or modifies install.sh or install.ps1 with hostile commands.

...[truncated 1410 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct remote-to-interpreter pipelines.
2. Prefer a trusted operating-system package manager or a signed, version-pinned release artifact.
3. If a standalone installer is necessary, split download and execution into separate steps.
4. Pin the installer to an immutable version rather than a mutable generic URL.
5. Publish the expected SHA-256 digest through an independent trusted release channel and verify it before execution.
6. Cryptographically sign release artifacts and require signature verification against a documented, pinned signing identity.
7. Save the installer locally and instruct the user to inspect it before running it.
8. Run installation with ordinary user privileges unless a narrowly defined operation demonstrably requires elevation.
9. Fail closed if checksum or signature verification fails; do not silently fall back to executing the downloaded content.
10. For automated environments, preinstall the verified CLI in a controlled image rather than dynamically retrieving executable code during Skill use.

A safer conceptual workflow is:

bash

curl -fSLo oo-installer.sh "https://trusted.example/releases/<pinned-version>/install.sh"
echo "<published-sha256>  oo-installer.sh" | sha256sum --check -
less oo-installer.sh
bash oo-installer.sh

Equivalent Windows guidance should use a pinned download, Get-FileHash, and signature validation before running the saved script. Placeholder values must be replaced with independently published, release-specific integrity information.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification and makes the execution path dependent on a live external endpoint, so a compromised server, CDN, DNS path, or TLS trust chain could lead to arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Static analysis

No suspicious patterns detected.