Nozbe

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:46 AM UTC
• Version: 1.0.2

Overview

This Nozbe skill is mostly purpose-aligned, but its setup instructions include unverified remote installer commands that could execute arbitrary code.

Review this before installing. The Nozbe actions are clearly described and state-changing actions require confirmation, but avoid running the documented curl | bash or irm | iex setup commands unless you trust the OOMOL installer source and have verified it through a safer, versioned or signed installation method.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:70
• Finding: Remote Bash Installer Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, line 70 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely retrieved script directly into Bash. The script is not pinned to an immutable version and is not checked against a cryptographic digest or publisher signature before execution. Consequently, the effective code executed by the Skill can change after the Skill package has been reviewed. HTTPS protects the connection in transit but does not establish that every future payload served by the URL is safe. Compromise of the hosting infrastructure, domain, CDN, deployment pipeline, or publisher account could cause arbitrary attacker-controlled shell commands to be returned and immediately executed. Installing the required CLI is related to the declared Nozbe connector functionality, but executing an unreviewed remote response directly in a shell exceeds the minimum safe privilege necessary. A downloaded installer can instead be pinned, independently verified, reviewed, and executed only after explicit user authorization. ### Attack Path 1. The `oo` CLI is absent, causing the agent or user to follow the first-time setup instructions. 2. An attacker compromises or gains control over the content returned by `https://cli.oomol.com/install.sh`. 3. `curl` retrieves the modified response. 4. The pipe passes the response directly to Bash without saving or validating it. 5. Bash executes the attacker-controlled commands with the privileges of the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The payload could read or alter accessible files, collect local credentials or session material, modify user configuration, install a ...[truncated 379 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation pattern. - Direct users to an official, versioned release artifact or trusted package manager. - Pin the CLI to an explicit version rather than retrieving a mutable installer endpoint. - Download the artifact to a local file before execution. - Publish and verify a cryptographic checksum and, preferably, a publisher signature. - Display the exact artifact, version, source, and requested action to the user. - Require explicit user approval before executing any installer. - Run installation with ordinary user privileges unless elevated access is demonstrably necessary. - Document the files, configuration, and network access that the installer requires.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:74
• Finding: Remote PowerShell Installer Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, line 74 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and passes its contents directly to `Invoke-Expression` (`iex`). `Invoke-Expression` interprets the response as PowerShell code without requiring local inspection, version pinning, checksum validation, or signature verification. The executable payload resides outside the audited project and can therefore change independently of this Skill. Although the URL uses HTTPS, compromise of the publisher or delivery infrastructure could replace the response with arbitrary PowerShell commands. Installing the CLI supports the declared functionality, but immediate interpretation of an unverified network response is not the least-privileged or minimum-risk installation method. ### Attack Path 1. The `oo` CLI is unavailable on a Windows host. 2. The agent or user follows the documented first-time setup command. 3. An attacker controls or compromises the payload returned by `https://cli.oomol.com/install.ps1`. 4. `irm` retrieves the attacker-modified script. 5. The pipeline supplies the response directly to `iex`. 6. PowerShell executes the commands with the invoking process's privileges. ### Impact Assessment Exploitation permits arbitrary PowerShell execution as the invoking user. The payload could access files and credentials available to that account, change PowerShell or user configuration, download additional programs, or create persistence. Execution from an elevated PowerShell session could permit system-wide changes. No such post-exploitation behavior is directly present in the reviewed `SKILL.md`; the risk arises because an externally muta ...[truncated 62 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Provide an official, versioned, immutable release package. - Pin the expected CLI version and cryptographic digest. - Require Authenticode or equivalent publisher-signature verification. - Download the installer to disk and verify it before execution. - Present the source, version, checksum, and intended changes to the user. - Obtain explicit user approval before launching the installer. - Avoid administrator privileges unless the installation explicitly requires them. - Prefer a trusted Windows package manager with version and publisher verification.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs use of `curl ... | bash`, which executes a remotely fetched script without integrity verification or review. If the distribution endpoint, transport, or upstream content is compromised, an operator or agent following these instructions could run arbitrary code on the host.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The instruction to use this skill for 'ANY Nozbe request' is overly broad and can override safer, more context-aware tool selection. Broad trigger language increases the chance an agent invokes a high-privilege skill in situations where a narrower skill, additional confirmation, or direct reasoning would be more appropriate.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: At L46, `get_comment` is documented with a `[write]` tag, which implies state change. But L59 states untagged get/list/search actions are reads, and by naming and surrounding pattern `get_comment` is clearly intended to be a read operation, so the documentation contradicts the action's apparent intent.

Static analysis

No suspicious patterns detected.