1Password Events API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:13 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for reading 1Password Events API data, but its setup instructions include direct execution of an unverified remote installer.

Review the installer source and prefer a verified package, pinned release, or manual installation path before using this skill. Also consider that 1Password event data will be accessed through an OOMOL-connected account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57

Finding

Unverified Remote Installer Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions pipe remotely retrieved content directly into Bash or PowerShell. Neither command pins the installer to an immutable version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded script before execution.

Consequently, the effective executable payload can change after the Skill has been audited. Compromise of the remote domain, DNS or network path, hosting infrastructure, TLS termination, or installer publishing account could turn these installation commands into arbitrary code-execution mechanisms. The Unix command also uses quiet curl options, limiting visibility into the transfer.

Installing a connector CLI can be necessary for the declared functionality, but immediate execution of an unverified remote response is not the minimum privilege or safest installation method required to query the read-only 1Password Events API.

Attack Path

1. The intended oo command is unavailable, causing the user or Agent to consult the first-time setup instructions.
2. An attacker compromises the installer publishing pipeline, hosting infrastructure, domain resolution, or another trusted delivery component.
3. The attacker replaces the expected installer response with a malicious shell or PowerShell payload.
4. The documented command retrieves the mutable response from cli.oomol.com.
5. The pipe passes the response directly to Bash or Invoke-Expression without integrity verification or inspection.
6. The malicious payload executes with all permissions available to the invoking user.

...[truncated 664 chars]

Remediation

View remediation

Remediation Suggestions

• Remove both direct curl | bash and irm | iex installation patterns.
• Use a trusted operating-system package manager or publish versioned release artifacts at immutable URLs.
• Pin the CLI to a reviewed version rather than retrieving an always-current installer.
• Download the artifact to a local file without executing it automatically.
• Publish a cryptographic signature or SHA-256 digest through an independently protected channel and require verification before execution.
• Permit inspection of the installer and require explicit user approval before running it.
• Run installation with ordinary user permissions unless a documented operation strictly requires elevation.
• Do not let the Agent automatically install tooling merely because an API action failed; distinguish command-not-found errors from authentication, connection, and service errors.
• Document that 1Password event requests and responses are processed by OOMOL so users can evaluate the sensitivity and trust implications of using the intermediary.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into bash, which is a classic supply-chain and remote-code-execution risk. If the install endpoint, network path, or hosting account is compromised, arbitrary code would execute on the user's machine with the agent's privileges; because this is embedded in a skill, the risk is amplified by making unsafe execution look like routine setup.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Static analysis

No suspicious patterns detected.