NocoDB

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.4

Overview

The skill is mostly coherent for managing NocoDB, but its setup instructions include running an unverified remote installer directly in a shell.

Review the installer source and prefer a signed, pinned, or package-manager installation path before using this skill. Once the `oo` CLI and NocoDB connection are already set up, the skill’s normal NocoDB operations are clearly scoped, but writes and deletes can change or remove real NocoDB data and should be approved carefully.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:78

Finding

Unverified Remote Installer Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 78–82
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The first-time setup instructions execute remotely hosted installation scripts directly through a command shell:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation commands combine retrieval and execution into a single operation. The effective code is hosted outside the reviewed project and can change after this Skill has been audited. No fixed installer version, cryptographic checksum, signature verification, or intermediate inspection step is specified.

Although installing the oo CLI is relevant when the required command is unavailable, executing mutable remote content immediately exceeds the minimum privileges and trust necessary for installation. The executed installer receives all permissions held by the user running bash or PowerShell. HTTPS protects data in transit but does not protect against compromise of the hosting account, release pipeline, origin server, DNS infrastructure, or signing process.

Attack Path

1. The oo command is unavailable, causing the user or Agent to follow the first-time setup instructions.
2. An attacker compromises the remote installer, its hosting infrastructure, or its delivery pipeline.
3. The user runs the documented curl | bash or irm | iex command.
4. The shell executes the attacker-controlled response immediately, without integrity or authenticity verification.
5. The payload performs arbitrary actions with the invoking user's privileges, potentially including credential theft, file modification, persistence installation, or further payload retrieval.

Impact Assessment

Successful exploitation provides arbitrary code execution under the acc ...[truncated 630 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash and irm | iex installation patterns.
2. Prefer a trusted operating-system package manager or an official package repository that validates signed metadata and artifacts.
3. If manual installation is required, pin an explicit CLI version and download the installer or binary as a separate file.
4. Publish and verify a cryptographic signature from a documented trusted key. At minimum, verify a version-specific SHA-256 checksum obtained through an independently protected channel.
5. Abort installation when signature or checksum verification fails.
6. Allow the downloaded script to be inspected before execution and run it as a separate command only after validation.
7. Do not recommend elevated privileges unless a documented installation step strictly requires them; isolate any privileged operation from unprivileged setup.
8. Pin or constrain connector and CLI versions where practical to prevent unreviewed updates from silently changing behavior.
9. Document the files, network endpoints, permissions, and configuration changes made by the installer so users can assess the required trust and privilege scope.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill instructs the agent/user to install software via curl ... | bash, which executes a remotely fetched script without verification. If the download source, transport, hosting account, or DNS/TLS trust chain is compromised, arbitrary code could run on the host with the user's privileges. In this skill context, that is especially risky because the tool is meant to access connected SaaS credentials and may run in environments with sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Static analysis

No suspicious patterns detected.