Nusii Proposals

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:29 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for managing Nusii Proposals, but its first-time setup recommends unverified remote installers that immediately execute local code.

Review this before installing if the oo CLI is not already present. Normal Nusii connector actions are disclosed and user-confirmed for writes, but avoid running the documented one-line remote installers unless you independently trust and verify the OOMOL installer source.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68
• Finding: Unverified Remote Installer Executed Through Bash## Vulnerability Details **File Location**: `SKILL.md`, line 68 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code:** ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable script from an external URL and pipes it directly into `bash`. The script is executed without version pinning, signature verification, checksum validation, or an opportunity to inspect the downloaded content. HTTPS protects data in transit but does not guarantee that the hosted script will remain identical to the version reviewed. Compromise of the vendor website, CDN, DNS infrastructure, publishing account, or build pipeline could change the effective payload at any time. The `-L` option also follows redirects, allowing the ultimate payload source to differ from the visible URL. Installing the CLI is relevant only during first-time setup, but immediate remote-to-shell execution exceeds the minimum privilege necessary to provide installation guidance. It also falls outside the declared `allowed-tools: [Bash(oo *)]` scope because the instruction invokes both `curl` and `bash`. ### Attack Path 1. The `oo` CLI is unavailable on the target system. 2. The agent or user follows the documented first-time setup instruction. 3. `curl` retrieves the current response from `https://cli.oomol.com/install.sh`, following redirects if supplied. 4. The response is passed directly to `bash` without integrity or authenticity verification. 5. If the remote hosting or publication chain has been compromised, attacker-controlled shell commands execute immediately. 6. The payload can access resources available to the invoking user and download or install additional components. ### Impact Assessment Successful exploitation grants arbitrary command execution with the privileges of the user running the installation com ...[truncated 335 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation pipeline. - Direct users to a signed operating-system package or trusted package manager. - Pin the CLI to a specific, immutable release version. - Download the installer or release artifact to a local file before execution. - Verify a vendor signature and a checksum obtained through an independently authenticated channel. - Present the file for inspection and obtain explicit user approval before executing it. - Avoid following arbitrary redirects, or validate that the resolved download host is an approved vendor endpoint. - Keep installation outside normal Skill execution and ensure all executable setup steps are consistent with the declared tool allowlist. - Document the permissions and filesystem changes required by the installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:72
• Finding: Unverified Remote Installer Executed Through PowerShell## Vulnerability Details **File Location**: `SKILL.md`, line 72 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code:** ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The PowerShell instruction retrieves a mutable script using the `Invoke-RestMethod` alias `irm` and immediately executes the response using the `Invoke-Expression` alias `iex`. No release version, cryptographic hash, digital signature, or publisher certificate is validated before execution. `Invoke-Expression` treats the network response as executable PowerShell source code. Consequently, any party able to modify the response delivered by the external endpoint can execute arbitrary commands. TLS alone does not mitigate compromise of the hosting account, server, CDN, DNS configuration, or release pipeline. Although installing the CLI supports first-time setup, direct execution of an unreviewed network response is not the least-privileged installation method. The command also falls outside the Skill's declared `Bash(oo *)` tool restriction. ### Attack Path 1. The `oo` CLI is unavailable on a Windows system. 2. The user follows the documented PowerShell setup instruction. 3. `Invoke-RestMethod` downloads the current content from `https://cli.oomol.com/install.ps1`. 4. The response is piped directly to `Invoke-Expression`. 5. If the endpoint or its delivery chain has been compromised, attacker-controlled PowerShell executes without validation. 6. The payload operates with the invoking process's privileges and can invoke additional Windows utilities or download further payloads. ### Impact Assessment Successful exploitation provides arbitrary PowerShell execution under the invoking user's security context. This can expose user files, environment variables, browser or developer credentials available to that user, and connected service ...[truncated 225 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Distribute the CLI through a signed Windows package or a trusted package manager. - Pin installation instructions to an immutable release version. - Download the installer to disk rather than evaluating the network response. - Validate the artifact's Authenticode signature, expected publisher, and pinned cryptographic checksum. - Require explicit user review and approval before execution. - Run installation with standard-user privileges unless elevated privileges are demonstrably required. - Document all expected files, registry changes, network endpoints, and permission requirements. - Keep installation outside automated Skill execution and align setup behavior with the declared tool allowlist.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill instructs users/agents to install software by piping a remotely fetched script directly into a shell, which is a well-known supply-chain and remote code execution risk. If the install endpoint, transport, hosting, or upstream release process is compromised, arbitrary code could run immediately on the host with the user's privileges.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use this skill for "ANY Nusii Proposals request" and "Whenever a task involves Nusii Proposals," which is a very broad activation condition without exclusions or negative examples. This can overlap with casual mentions or high-level discussion about Nusii rather than concrete requests to operate the service.

Static analysis

No suspicious patterns detected.