1Password Events API

• Outcome: Review
• Latest audit: Sep 15, 2026 · 6:15 AM UTC
• Version: 1.0.2

Overview

This skill is mostly coherent for reading 1Password Events API data through OOMOL, but it asks users or agents to run unverified remote installer scripts and routes sensitive security telemetry through a third-party connector.

Review this before installing. Use safer verified installation instructions for the oo CLI instead of piping remote scripts into a shell, and only connect 1Password Events API data to OOMOL if your organization is comfortable with OOMOL processing that audit and sign-in telemetry under its documented controls.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:52
• Finding: Unverified Remote Installer Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-62` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute them through Bash or PowerShell. Neither workflow pins an installer version, verifies a cryptographic signature or checksum, nor gives the user an opportunity to inspect the downloaded content before execution. Consequently, the code that ultimately runs is not contained in the audited Skill package and can change after the audit. The effective payload depends on the current response from the remote server. Compromise of the hosting infrastructure, publishing process, or another trusted delivery component could turn the documented installation command into an arbitrary-code execution path. Although installation is presented as a fallback for a missing CLI rather than an automatic routine, executing an unverified remote response is not the minimum privilege necessary to install the dependency safely. ### Attack Path 1. The `oo` command is unavailable, causing the user or agent to follow the first-time setup instructions. 2. Bash or PowerShell requests the installer from `cli.oomol.com`. 3. A compromised hosting or release-delivery component supplies a modified installer. 4. The shell executes the response immediately without integrity or authenticity verification. 5. The installer executes arbitrary commands with the privileges of the user who launched the installation. ### Impact Assessment Successful exploitation provides arbitrary comm ...[truncated 469 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct execution pipelines (`curl | bash` and `irm | iex`). 2. Distribute the CLI through a trusted, version-pinned package manager or release artifact. 3. Download the installer to a local file before execution so it can be inspected. 4. Publish a cryptographic signature and a version-specific checksum from an independently protected channel. 5. Verify the signature or checksum before running the installer and fail closed if verification fails. 6. Require explicit user approval before installing software or running any downloaded executable. 7. Run installation with ordinary user privileges unless a documented step strictly requires elevation. 8. Document the expected files, network destinations, and permission changes made by the installer. ]]>

other

Warning

• Location: SKILL.md:3
• Finding: Sensitive 1Password Event Data Routed Through a Third-Party Connector<; OOMOL injects credentials server-side, so you never handle raw tokens. ``` ```bash oo connector run "one_password_events" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill instructs the agent to route every 1Password Events API request through an OOMOL-managed connector instead of accessing the official API directly. The available operations return audit events, item-usage events, and sign-in attempts, all of which can contain security-sensitive organizational telemetry. The use of an intermediary is disclosed and is part of the Skill's declared connector-based design. Nevertheless, it adds a third-party trust boundary that is not inherently necessary for the underlying read-only 1Password API functionality. Request payloads, query parameters, response data, and execution metadata may pass through infrastructure outside the user's 1Password environment. The statement that credentials are injected server-side also means authorization material is managed by that intermediary, although no raw credential disclosure or misuse is demonstrated in the audited file. The broad instruction to use the connector for “ANY” request prevents selection of a lower-exposure direct API path. The file does not document data retention, logging behavior, encryption controls, tenant isolation, or scope restrictions for the con ...[truncated 1281 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the unconditional “ANY request” routing mandate with an explicit description of when use of the OOMOL connector is required. 2. Obtain informed user approval before transmitting 1Password event data through a third-party service. 3. Offer direct use of the official 1Password Events API when technically feasible. 4. Document which request fields, response fields, credentials, and metadata OOMOL receives, stores, or logs. 5. State applicable retention periods, deletion controls, encryption protections, tenant-isolation measures, and subprocessors. 6. Restrict the connected credential to the minimum read-only scopes required for the three documented actions. 7. Minimize requested records and fields, and avoid sending unrelated sensitive information in connector payloads. 8. Provide audit logs and a straightforward connection-revocation mechanism. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to install software by piping a remotely fetched script directly into a shell (`curl ... | bash`). This creates a supply-chain and remote-code-execution risk: if the host, transport, installer, or upstream distribution process is compromised, arbitrary code will run immediately with the user's privileges. In this skill context, the danger is elevated because the installer is embedded as an operational fallback step inside a security-sensitive integration workflow, making execution more likely during routine use.

Static analysis

No suspicious patterns detected.