Security audit

1Password

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to read 1Password through OOMOL, but it handles very sensitive secret data with broad automatic scope and includes unsafe remote install commands.

Review before installing. Use this only with a narrowly scoped, read-only 1Password Connect token and avoid broad vault access. Do not let an agent run the curl-to-bash or PowerShell iex installer automatically; install the oo CLI through a verified, user-controlled process. Confirm the exact vault/item before retrieving full 1Password items, and consider whether routing those secrets through OOMOL is acceptable for your security model.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:60
Finding: Unverified Remote Installation Scripts Executed Directly by the Shell
Content: View full analysis
Remediation: View remediation
/oo-release.tar.gz" curl -fSLo oo-release.tar.gz.sig "https://trusted.example/releases/oo//oo-release.tar.gz.sig" gpg --verify oo-release.tar.gz.sig oo-release.tar.gz # Extract and install only after successful signature verification. ``` ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:3
Finding: Sensitive 1Password Requests and Results Are Routed Through an Additional Third-Party Trust Boundary
Content: View full analysis
" --data '' --json ``` ```text - `get_item` — Get one full 1Password item by vault UUID and item UUID. ``` ### Technical Analysis The Skill directs every 1Password request through the OOMOL CLI and server-side connector instead of allowing direct use of an official 1Password interface. Although the documentation discloses this architecture, it introduces the CLI, OOMOL account, connector service, and server-side credential handling as additional trust boundaries for highly sensitive password-manager operations. The `get_item` action retrieves a full item. Consequently, requests identifying vaults and items, as well as potentially sensitive response content, pass through connector infrastructure. The instruction to use this Skill for any 1Password request applies even where direct access or retrieval of a smaller set of fields would meet the user's objective. The audit did not establish covert exfiltration or misuse by OOMOL. The confirmed issue is the forced, broad intermediary architecture and resulting least-privilege risk. Its effective scope is determined by the permissions granted to the connected 1Password Connect access token. ### Attack Path 1. A user asks the agent to search for or retrieve information from 1Password. 2. The Skill instructs the agent to use ...[truncated 1228 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
- `get_health` — Get health details for the configured 1Password Connect Server. - `get_item` — Get one full 1Password item by vault UUID and item UUID. - `get_vault` — Get details for one 1Password vault by UUID. - `list_activity` — List 1Password Connect activity events visible to the access token. - `list_items` — List item overviews in one 1Password vault. - `list_vaults` — List 1Password vaults available to the connected Connect access token.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
- `get_health` — Get health details for the configured 1Password Connect Server. - `get_item` — Get one full 1Password item by vault UUID and item UUID. - `get_vault` — Get details for one 1Password vault by UUID. - `list_activity` — List 1Password Connect activity events visible to the access token. - `list_items` — List item overviews in one 1Password vault. - `list_vaults` — List 1Password vaults available to the connected Connect access token.

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The skill recommends installing the CLI via a curl-piped-to-bash command, which executes remote code without verification and creates a direct supply-chain execution path. Because this content lives inside an agent skill, an agent following fallback setup steps could be induced to run unverified shell code on the host environment.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description instructs the agent to use this skill for ANY 1Password request, which is an overly broad trigger and can cause the skill to activate on casual mentions or ambiguous requests involving 1Password. In this context, unintended invocation is meaningful because the skill exposes high-sensitivity secret-management read actions such as listing vaults and retrieving full items.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.