Okta

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:01 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for Okta administration, but its first-time setup tells an agent to execute unverified remote installer scripts and it covers high-impact identity changes.

Review this skill carefully before installing. Use it only with an Okta account and OOMOL connection you trust, require explicit confirmation for every write or destructive Okta action, and avoid the documented pipe-to-shell installer path unless you independently verify the CLI installer or use a safer signed/package-managed installation method.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68
• Finding: Unverified Remote Installer Downloaded and Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 68 and 72 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Complete vulnerable code snippets:** ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and pass their contents directly to Bash or PowerShell. No fixed release version, cryptographic signature, or checksum is specified, and users have no mandatory inspection step before execution. HTTPS protects data in transit when the endpoint and trust chain remain secure, but it does not establish that the retrieved script is the same artifact that was reviewed. The effective payload may change after the Skill is published. Compromise of the hosting service, publishing account, DNS infrastructure, or TLS termination environment could therefore turn the installation commands into a remote-code-execution delivery channel. Installing the CLI is relevant only when it is missing. Directly executing an unverified network response exceeds the minimum privilege and trust necessary to install that dependency safely. ### Attack Path 1. The `oo` command is unavailable, causing the documented first-time setup path to be used. 2. An attacker compromises or gains publishing control over the installer endpoint or its delivery infrastructure. 3. The attacker replaces the installer response with commands that perform unauthorized actions. 4. The user or agent runs the documented `curl | bash` or `irm | iex` command. 5. The shell immediately executes the attacker-controlled response without integrity verification or review. 6. The payload operates with the privileges and accessible environment of the invoking account. ### Impact Assessment A substituted ...[truncated 1004 chars]
• Remediation: ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands. 2. Pin the CLI to an explicitly reviewed release and immutable version. 3. Download the installer or package to disk without executing it: ```bash curl -fL --output oo-installer.sh "https://example.invalid/releases/VERSION/install.sh" ``` 4. Publish the expected SHA-256 digest through a separately protected release channel and verify it before execution: ```bash echo "EXPECTED_SHA256 oo-installer.sh" | sha256sum --check - ``` 5. Prefer cryptographic release signatures and verify them against a pinned, independently distributed public key. 6. Execute the verified artifact in a separate, explicit step and avoid requesting administrator privileges unless installation genuinely requires them. 7. Prefer a reputable platform package manager with version pinning and signed package metadata. 8. Document the installer's expected filesystem changes, network destinations, and required privileges so users can validate its scope. 9. Retain the existing instruction to invoke setup only after a genuine command-not-found failure, but require human approval before downloading or executing installation code.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell, which creates a supply-chain and remote-code-execution risk if the host, transport, or published script is compromised. This is more dangerous in this context because the skill is for Okta administration, so compromise of the local environment could expose a path to high-value identity operations or tamper with subsequent administrative actions.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill description routes essentially every Okta-related task through this skill, including read, write, and destructive operations, without narrowing scope or requiring stronger gating at invocation time. In an agent setting, this broad trigger increases the chance the skill is selected for sensitive identity-management actions and amplifies the blast radius of prompt mistakes or ambiguous user requests.

Static analysis

No suspicious patterns detected.