npm

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:02 AM UTC
• Version: 1.0.2

Overview

This npm lookup skill is mostly coherent, but its fallback setup tells users or agents to execute unverified remote installer scripts and routes all npm requests through an account-linked third-party connector.

Install only if you are comfortable using OOMOL as an intermediary for npm queries tied to your connected account. Do not run the pasted remote installer commands as-is; prefer a verified, signed, or package-manager installation method and review what npm data will be sent through the connector.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62
• Finding: Unverified Remote Shell Script Execution via curl and bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a shell script from an external server and pipes it directly into `bash`. The payload is neither pinned to an immutable version nor inspected or authenticated through a cryptographic signature or checksum before execution. Consequently, the code that runs can change after the Skill has been reviewed. Compromise of the hosting server, DNS resolution, deployment pipeline, or publishing account could turn this command into an arbitrary-code execution channel. HTTPS protects the connection in transit but does not establish that the current remote script is the same artifact that was audited. The behavior is not necessary for the Skill's primary read-only npm lookup functionality. Installation is only a fallback for a missing CLI, but the instructions still expose users or an executing agent to a mutable remote payload. ### Attack Path 1. The `oo` command is unavailable, causing the agent or user to follow the first-time setup instructions. 2. An attacker compromises the remote script, its hosting infrastructure, or the associated release process. 3. `curl` retrieves the attacker-controlled script. 4. The pipe sends the response directly to `bash` without review or integrity verification. 5. The payload executes with all privileges available to the invoking user. 6. The payload can access user-readable data, modify files, install additional software, or establish persistence where local permissions allow. ### Impact Assessment Successful exploitation provides arbitrary shell-code execution under the invoking user's account. The accessible scope can include project files, user-owned configuration, environment variables, active credential ...[truncated 319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the direct `curl | bash` installation path. - Distribute versioned, immutable release artifacts through a trusted release channel. - Download the installer without executing it, then verify a publisher signature and a documented SHA-256 or stronger digest. - Pin the installer and CLI to an explicit reviewed version rather than a mutable URL. - Display the verified script or package source for inspection before execution. - Require explicit user approval before installing software. - Run installation with ordinary user privileges and request elevation only for a narrowly defined operation when strictly necessary. - Prefer a signed platform package manager installation where available. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote PowerShell Execution via Invoke-RestMethod and Invoke-Expression<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The command uses `Invoke-RestMethod` (`irm`) to retrieve PowerShell source from an external URL and immediately passes the response to `Invoke-Expression` (`iex`). This treats mutable network content as trusted local code. The instruction provides no version pinning, Authenticode validation, detached signature verification, or cryptographic digest check. The executed payload can therefore differ from the content originally reviewed. Compromise of the hosting or publication infrastructure would allow the response to contain arbitrary PowerShell instructions. This installation behavior exceeds the minimum capability needed to perform the Skill's declared read-only npm operations. It is only a convenience fallback for a missing CLI and should not bypass normal artifact verification and user consent. ### Attack Path 1. The `oo` executable is absent on a Windows system. 2. The agent or user follows the documented PowerShell setup command. 3. An attacker gains control of the hosted script or its delivery pipeline. 4. `Invoke-RestMethod` downloads the modified PowerShell source. 5. `Invoke-Expression` executes the response immediately without integrity or publisher verification. 6. The payload performs arbitrary actions available to the current PowerShell process. ### Impact Assessment Successful exploitation grants arbitrary PowerShell execution with the invoking user's privileges. Potential scope includes user files, project data, accessible environment variables and credentials, registry entries writable by the user, and network resources available in the current session. Execution from an elevated PowerShell session could permit system-wide changes. The artifac ...[truncated 139 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `irm | iex` installation instruction. - Provide a versioned installer package or script that can be downloaded separately and reviewed before execution. - Require Authenticode or equivalent publisher-signature validation. - Publish and verify a cryptographic checksum over an immutable release artifact. - Pin installation instructions to a specific reviewed CLI version. - Require explicit user confirmation before installation and clearly state the requested privileges. - Avoid elevated execution unless a specific installation step demonstrably requires it. - Prefer a signed package delivered through a reputable Windows package manager. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:2
• Finding: Overbroad Instruction Routes All npm Requests Through an External Connector<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 2–4 and 13–29 **Vulnerability Type**: Skill instruction hijacking and unnecessary external data routing **Risk Level**: Medium ### Vulnerable Code ```yaml name: oo-npm description: "npm (npmjs.com). Use this skill for ANY npm request — searching and reading data. Whenever a task involves npm, use this skill instead of calling the API directly." allowed-tools: [Bash(oo *)] ``` ```markdown Operate **npm** through your OOMOL-connected account. This skill calls the `npm` connector with the [oo CLI](https://github.com/oomol-lab/oo-cli); OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```bash oo connector schema "npm" --action "<action_name>" ``` ```bash oo connector run "npm" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill instructs the agent to use this connector for **any** npm request and explicitly directs it not to call npm's API directly. This persistently redirects even public package searches and metadata lookups through an account-linked third-party service. The connector command sends the JSON payload to OOMOL, while the live schema and connector behavior are retrieved or exercised at runtime. This introduces an external intermediary and exposes npm query contents and associated activity when direct public-registry access could be sufficient. The reviewed file does not instruct the agent to read local tokens, SSH keys, or other local secrets. It also states that npm credentials are injected server-side. Therefore, local credential exfiltration is not established. The confirmed concern is unnecessary network disclosure and overbroad routing beyond the minimum privilege required for public npm data. ### Attack Path 1. A user requests public npm information, such as a package search or manifest lookup. 2. The Skill's global instruction causes the agent to select OOMOL instead of npm's public interface. 3. The agent ...[truncated 952 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the instruction to use the Skill for “ANY npm request” with narrowly scoped activation criteria. - Use npm's direct public interfaces for searches and public package metadata that do not require account access. - Invoke the OOMOL connector only for functionality that explicitly requires the connected account or service. - Clearly disclose which request fields and metadata are transmitted to OOMOL. - Obtain user consent before sending potentially sensitive package names, private project identifiers, or account-linked queries to an intermediary. - Pin and document connector schema expectations where practical, and validate returned data before relying on it. - Preserve the existing restriction against proactive authentication and avoid requesting broader npm scopes than each supported action needs. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

## Available actions

- `audit_package_versions` — Get npm security advisories for requested exact package versions.
- `get_current_user` — Get the npm username associated with the connected access token.
- `get_package` — Get a compact summary and version list for an npm package.
- `get_package_download_counts` — Get download totals for up to 128 npm packages over an inclusive period.
- `get_package_download_trend` — Get daily download counts for one npm package over an inclusive period.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs the agent to install the CLI via a remote script piped directly into a shell (`curl ... | bash`), which is a classic unsafe pattern. If the remote host, transport, or distribution channel is compromised, arbitrary code would execute immediately on the user's machine; because this appears in a fallback workflow inside the skill, it increases the chance an agent may suggest or run it automatically during troubleshooting.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description says to use this skill for "ANY npm request" and "Whenever a task involves npm," which is a very broad activation condition that can overlap with many general software tasks. It does not provide limiting conditions, exclusions, or concrete boundaries for when the skill should not be invoked.

Static analysis

No suspicious patterns detected.