Northbeam

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:15 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Northbeam connector, but its first-time setup tells agents to run unverified remote installer scripts that can modify the user's machine.

Review before installing. The Northbeam connector actions themselves are read-oriented and the skill says credentials are handled server-side by OOMOL, but first-time setup can execute remote installer code on your machine. Install the oo CLI only through a source and verification process you trust, and do not let an agent run the installer automatically without your explicit approval.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Bash Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:59` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command downloads a mutable script from an external server and pipes it directly into Bash. The remote payload is executed without prior inspection, version pinning, checksum validation, or signature verification. Although `cli.oomol.com` is consistent with the declared OOMOL integration, the project contains no immutable installer reference or integrity information. Consequently, the code executed by this command can differ from the code available when the Skill was audited. Compromise of the hosting service, DNS or TLS trust chain, release process, or installer itself could turn the documented setup command into an arbitrary-code-execution mechanism. Installing software may be a legitimate prerequisite, but executing an unverified remote script exceeds the minimum privileges needed for the Skill's declared read-only Northbeam operations. ### Attack Path 1. The agent attempts to use the Skill on a system where the `oo` CLI is unavailable. 2. The command fails with `oo: command not found`. 3. The agent follows the documented first-time setup instruction. 4. `curl` retrieves the current contents of `https://cli.oomol.com/install.sh`. 5. The downloaded response is passed directly to Bash without integrity verification. 6. A compromised or malicious installer executes with the privileges of the user running the agent. ### Impact Assessment The remote script can execute arbitrary commands with the invoking user's privileges. Depending on those privileges, it could read or modify local files, access credentials available to the process, install additional programs, modify shell configuration, establish persistence, or transmit sensitive data. If invoked from ...[truncated 82 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the pipe-to-shell command with installation through a trusted package manager or a version-pinned release artifact. 2. Download the installer to a local file without executing it immediately. 3. Publish and require verification of a SHA-256 digest or cryptographic signature obtained through an independently protected channel. 4. Pin the installer to an immutable version rather than a mutable `install.sh` URL. 5. Require explicit user approval before installing software or executing any downloaded code. 6. Document the installer's expected files, permissions, network destinations, and system changes. 7. If a script remains necessary, use a safer workflow such as: ```bash curl -fLo install.sh https://cli.oomol.com/releases/<pinned-version>/install.sh echo "<trusted-sha256> install.sh" | sha256sum --check - less install.sh bash install.sh ``` 8. Do not suggest elevated execution unless it is strictly necessary, and clearly identify any operations that require administrative privileges. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote PowerShell Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:63` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This command retrieves a mutable PowerShell script using `Invoke-RestMethod` (`irm`) and passes the returned content directly to `Invoke-Expression` (`iex`). `Invoke-Expression` interprets the response as executable PowerShell code without saving it for inspection or validating its origin beyond ordinary HTTPS transport. The project does not pin an installer version or provide a checksum or digital-signature verification step. Therefore, control over the remote response provides control over the commands executed on the local Windows host. Trust in the declared OOMOL domain does not remove the supply-chain risk created by direct execution of mutable remote content. The Skill's intended functions are read-only Northbeam queries. Automatic execution of an unverified installer introduces substantially broader local privileges than those queries require. ### Attack Path 1. The agent attempts to use the Skill on Windows without the `oo` CLI installed. 2. The missing-command failure triggers the documented first-time setup process. 3. PowerShell downloads the current response from `https://cli.oomol.com/install.ps1`. 4. The pipeline forwards the response directly to `Invoke-Expression`. 5. If the hosting infrastructure or installer is compromised, attacker-controlled PowerShell commands execute under the invoking user's security context. ### Impact Assessment An attacker controlling the installer response could run arbitrary PowerShell commands, read user-accessible files and credentials, alter the user's profile or PowerShell configuration, install software, contact additional network services, or create persistence. Execution from an elevated PowerShell session c ...[truncated 56 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `irm ... | iex` installation pattern. 2. Distribute the CLI through a trusted, signed package mechanism or an immutable versioned release. 3. Download the installer separately and verify an Authenticode signature or a securely published cryptographic digest before execution. 4. Require explicit user approval after displaying the artifact's source, version, and intended system changes. 5. Avoid requesting elevation unless a documented installation step strictly requires it. 6. Use a verification workflow similar to: ```powershell Invoke-WebRequest ` -Uri "https://cli.oomol.com/releases/<pinned-version>/install.ps1" ` -OutFile ".\install.ps1" if ((Get-FileHash ".\install.ps1" -Algorithm SHA256).Hash -ne "<TRUSTED_SHA256>") { throw "Installer integrity verification failed." } Get-AuthenticodeSignature ".\install.ps1" # Execute only after successful verification and explicit user approval. & ".\install.ps1" ``` 7. Document the installer's expected filesystem, registry, environment, and network changes so users can assess the requested privileges. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill includes software installation behavior even though its stated purpose is handling Northbeam data requests. Allowing shell-based installation gives the agent authority to modify the host environment and execute unreviewed code paths unrelated to the user’s data query, increasing the attack surface substantially.

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The command pipes a remotely fetched script directly into bash, which is a classic unsafe execution pattern. If the remote endpoint, transport, or distribution channel is compromised, the agent could immediately execute arbitrary code on the host with the current user's privileges.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill is presented as a read/search interface for Northbeam data, but its instructions also authorize environment-changing actions such as authentication and CLI setup. That scope expansion can cause an agent to perform account or system modifications the user did not intend when invoking a supposedly data-read skill.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation trigger says to use this skill for ANY Northbeam request, which is broader than necessary and can cause the skill to intercept diverse tasks automatically. In combination with shell tool access, broad routing increases the chance that benign Northbeam-related prompts lead to command execution or fallback setup steps without narrowly scoped intent.

Static analysis

No suspicious patterns detected.