Ninox

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for Ninox automation, but its first-time setup tells users to execute unverified remote installer scripts, which warrants Review before installation.

Review the installer path before installing. Normal Ninox reads and user-confirmed writes/deletes are consistent with the skill's purpose, but do not run the documented curl|bash or irm|iex setup commands unless you trust OOMOL's CLI distribution path and have independently inspected or verified the installer. Pay special attention before allowing record deletion or bulk updates in Ninox.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63

Finding

Unverified Remote Installation Scripts Are Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–70
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from cli.oomol.com and immediately execute the returned content using Bash or PowerShell. Neither command pins a script version, verifies a cryptographic signature or checksum, nor provides an inspection step before execution.

Although installing the oo CLI supports the Skill's declared Ninox functionality, direct download-and-execute behavior gives the remote server control over the code executed on the local system. The effective payload can change after the Skill has been reviewed. Compromise of the distribution server, associated CDN, DNS resolution, TLS termination infrastructure, or release process could therefore turn these installation commands into an arbitrary-code-execution channel.

This behavior exceeds the minimum privileges necessary to document CLI installation because safer installation mechanisms can separate downloading, verification, and execution.

Attack Path

1. The oo CLI is absent, causing an oo: command not found error.
2. The agent or user follows the first-time setup instructions in SKILL.md.
3. curl or Invoke-RestMethod retrieves a mutable installation script from the remote server.
4. The response is passed directly to Bash or Invoke-Expression without integrity verification or review.
5. If the upstream delivery path has been compromised, attacker-controlled commands execute with the privileges of the invoking account.
6. Those commands can access data available to that account, alter local files, steal credentials, install additional paylo ...[truncated 646 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both pipe-to-shell installation commands.
2. Prefer an official operating-system package manager or a version-pinned release artifact.
3. Download the installer to a local file rather than executing the network response directly.
4. Publish a SHA-256 or stronger checksum through an independently protected channel and require verification before execution.
5. Cryptographically sign release artifacts and document signature verification using a pinned signing identity.
6. Pin the installer and CLI to a specific reviewed version instead of using a mutable generic URL.
7. Instruct users to inspect the downloaded script before running it.
8. Run installation with ordinary user privileges unless a narrowly defined step demonstrably requires elevation.
9. Document the files, directories, network endpoints, and permissions used by the installer so users can assess its effects.
10. If automated installation remains necessary, fail closed when integrity or signature verification cannot be completed.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

- `list_databases` — List Ninox databases inside one workspace.
- `list_records` — List records from one Ninox table.
- `list_tables` — List Ninox tables for one database.
- `list_workspaces` — List Ninox workspaces available to the authenticated Personal Access Token.
- `save_records` — Create new Ninox records or update existing ones in the same table using the native POST /records endpoint. [write]
- `search_record` — Find a single Ninox record by filters in one table.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill recommends installing software via a remote script piped directly into a shell, which is a classic supply-chain and arbitrary code execution risk. If the install endpoint, transport path, or hosting account is compromised, users could execute attacker-controlled code with their local privileges.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for ANY Ninox request and instead of calling the API directly, which is an overly broad routing instruction. This can cause over-invocation of the skill for ambiguous requests and increases the chance that high-risk write or destructive operations are funneled through a powerful connector without adequate task-level scoping.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.