Novu

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:40 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for managing Novu through OOMOL, but its first-time setup tells users to run unverified remote installer scripts directly.

Install only if you are comfortable with OOMOL's connector controlling your Novu account. Avoid running the pipe-to-shell installer commands as written; prefer reviewing or verifying the installer through official, versioned installation steps, and confirm every write payload before letting the agent run it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Bash Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, line 59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction retrieves a mutable shell script from an external server and pipes it directly into Bash. The downloaded content is not pinned to a specific release and is not subject to checksum, signature, or local inspection before execution. HTTPS protects the connection in transit but does not establish that the current server-side payload is the same code that was reviewed. Compromise of the hosting infrastructure, domain, distribution account, or installer-generation process could therefore turn this instruction into an arbitrary-code execution channel. The command appears only as a first-time setup fallback when the `oo` CLI is unavailable, rather than as part of every Novu operation. Nevertheless, executing a remote installer is broader than the minimum privilege needed to operate Novu through an already installed CLI. ### Attack Path 1. The `oo` command is unavailable and an installation fallback is initiated. 2. An attacker compromises the installer host, its deployment pipeline, or another component capable of changing `https://cli.oomol.com/install.sh`. 3. The Agent or user runs the documented command. 4. `curl` downloads the attacker-controlled response without saving it for review or verifying its integrity. 5. Bash immediately interprets the response as shell commands. 6. The malicious installer executes with all permissions available to the invoking Agent or user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. Depending on that account's permissions and the installer's use of privilege elevation, an attacker could read or modify accessible files, steal ...[truncated 318 chars]
• Remediation: ## Remediation Suggestions - Replace the pipe-to-shell command with installation from a version-pinned, trusted release artifact. - Download the installer to a local file without executing it immediately. - Publish and verify a cryptographic checksum and, preferably, a signature rooted in a separately distributed trusted key. - Display the artifact source, version, and verification result before execution. - Require explicit user approval before installing software or running any downloaded script. - Execute the installer with ordinary user privileges unless a narrowly scoped operation demonstrably requires elevation. - Prefer a signed operating-system package or trusted package manager with lockable versions and provenance verification.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote PowerShell Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The PowerShell installation instruction downloads a mutable script using `Invoke-RestMethod` and passes its response directly to `Invoke-Expression`. This causes the response body to be interpreted immediately as PowerShell code. No fixed release version, checksum, Authenticode verification, detached signature, or local review step is required. As a result, the command creates a remote-code execution boundary controlled by the content currently returned from the external URL. This behavior is documented as a first-time setup fallback rather than a routine Novu action. Even so, it grants the remote installer the full effective privileges of the PowerShell process and exceeds the privileges needed merely to invoke an existing Novu connector. ### Attack Path 1. The `oo` CLI is missing on a Windows system and the setup fallback is followed. 2. An attacker gains control over the installer endpoint, hosting account, or release pipeline. 3. The endpoint returns an attacker-controlled PowerShell payload. 4. `Invoke-RestMethod` retrieves the payload. 5. The pipeline passes the response directly to `Invoke-Expression`. 6. PowerShell executes the payload with the permissions of the invoking user. ### Impact Assessment Successful exploitation permits arbitrary PowerShell execution under the current account. This can expose accessible files, environment variables, browser or application data, local credentials, and connected resources. The payload could also modify user configuration, install programs, or create persistence where the account has sufficient permissions. There is no evidence in the reviewed file that the currently hosted installe ...[truncated 168 chars]
• Remediation: ## Remediation Suggestions - Distribute a signed, version-pinned PowerShell installer or packaged release. - Download the script to disk before execution and verify its cryptographic hash against a value obtained through a trusted, independent channel. - Require a valid Authenticode or detached signature and fail closed if verification does not succeed. - Avoid `Invoke-Expression` for network responses. - Require explicit user approval after presenting the artifact version, publisher, source, and verification status. - Run installation with least privilege and avoid requesting administrative elevation unless a specific operation requires it. - Document removal and rollback procedures for any files or configuration created by the installer.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs use of a remote install command that pipes a downloaded script directly into `bash`, which executes unverified code from the network. If the distribution endpoint, transport chain, or script content is compromised, an agent following this guidance could execute arbitrary attacker-controlled code on the host.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text says to use this skill for "ANY Novu request," which is overly broad and can cause the agent to invoke this skill for incidental mentions or low-risk tasks without sufficient routing constraints. In a skill that can perform write actions against a live third-party service, overbroad invocation increases the chance of unintended state changes or unnecessary exposure to setup/install flows.

Static analysis

No suspicious patterns detected.