OnceHub

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:29 AM UTC
• Version: 1.0.2

Overview

The skill is a mostly scoped OnceHub read connector, but its setup instructions ask users or agents to run remote installer scripts directly in a shell.

Review before installing. Use this skill only if you trust OOMOL and the oo CLI distribution path, and prefer installing the CLI through a verified package or separately downloaded, inspected, and verified installer. Expect the skill to read OnceHub booking-related data through your connected OOMOL account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Unverified Remote Installer Scripts Executed Directly from the Network<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57–61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions pipe remotely downloaded content directly into Bash or PowerShell. Neither command pins an immutable installer version, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded script before execution. Although HTTPS protects the network transport, it does not establish that the retrieved script is immutable or safe. If the hosting service, publishing account, DNS resolution, TLS infrastructure, or installer delivery pipeline is compromised, the response can be replaced with arbitrary commands. The effective code executed by the Skill can therefore change after the reviewed `SKILL.md` file remains unchanged. This behavior is not required for the Skill's declared runtime function of reading OnceHub data. Normal operation only requires the `oo` connector CLI. Automatically recommending unrestricted remote script execution when that CLI is absent exceeds the minimum privileges needed for the connector operation. ### Attack Path 1. The `oo` command is unavailable, causing the first-time setup instructions to become applicable. 2. An attacker compromises or gains control over the remote installer delivery path, such as the hosting service, publishing account, DNS, or associated infrastructure. 3. The attacker modifies the response from `install.sh` or `install.ps1` to contain malicious commands. 4. The user or Agent runs the documented installation command. 5. Bash or PowerShell executes the response immediately without integrity verification or prior inspection. 6. The payload operates with the priv ...[truncated 712 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands. 2. Direct users to an official package manager or a signed, versioned release artifact. 3. Pin the installer to a specific immutable release rather than a mutable generic URL. 4. Download the installer to a local file without executing it immediately. 5. Publish and verify a SHA-256 or stronger checksum over the downloaded artifact. 6. Prefer cryptographic signature verification using a trusted, separately distributed signing key. 7. Allow the user to inspect the downloaded script before execution. 8. Require explicit user approval before running any installer. 9. Run installation with ordinary user privileges unless elevation is demonstrably necessary. 10. Document the expected files, permissions, and system changes made by installation. A safer workflow is: ```bash curl -fSLo oo-install.sh "https://example.invalid/releases/<pinned-version>/install.sh" echo "<trusted-sha256> oo-install.sh" | sha256sum --check less oo-install.sh bash oo-install.sh ``` The actual release URL and checksum must come from a trusted, authenticated release channel. PowerShell installation should follow the equivalent download, signature or hash verification, inspection, and explicit execution sequence. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 95% confidence
• Finding: The skill instructs users to install the CLI by piping a remotely fetched script directly into `bash`, which executes unverified code from the network. If the install endpoint, transport chain, or hosting account is compromised, this becomes an immediate arbitrary code execution path on the user's machine.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY OnceHub request" and "Whenever a task involves OnceHub," which is extremely broad and lacks limiting conditions or negative examples. In a manifest/markdown context, this can overlap with many routine mentions of OnceHub and makes it unclear when the skill should not activate.

Static analysis

No suspicious patterns detected.