Oomnitza

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:25 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a read-focused Oomnitza connector, but its setup instructions include unverified remote installer commands that should be reviewed before use.

Before installing, review the oo CLI installation method carefully. Prefer a signed or checksummed installer, a trusted package manager, or a separately downloaded script you can inspect, and do not run the setup commands with elevated privileges unless OOMOL documents that requirement. Runtime use for listed Oomnitza read actions appears aligned with the skill's purpose.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Shell Installer Execution on macOS and Linux## Vulnerability Details **File Location**: `SKILL.md`, line 59 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely downloaded script directly into Bash. The effective executable content is controlled by the remote endpoint and can change after the Skill has been reviewed. No fixed release version, cryptographic checksum, or publisher signature is verified before execution, and the pipeline prevents meaningful inspection prior to execution. Although installing the `oo` CLI supports the declared Oomnitza connector functionality, immediate execution of mutable remote content is not the minimum privilege or safest mechanism necessary to perform that installation. Trust in the named HTTPS domain alone does not mitigate compromise of its hosting account, distribution infrastructure, DNS, CDN, TLS termination, or release process. ### Attack Path 1. An attacker compromises, gains unauthorized publishing access to, or otherwise controls the content returned by `https://cli.oomol.com/install.sh`. 2. The attacker modifies the installer to include arbitrary shell commands. 3. A user or agent encounters the documented `oo: command not found` condition and follows the installation instruction. 4. `curl` retrieves the attacker-controlled response and pipes it directly to Bash without integrity verification. 5. Bash executes the payload with the privileges of the invoking account. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's privileges. The payload could read or modify files accessible to that account, access locally available credentials or session material, install additional software, tamper with development tooling, or attempt persistence and privileg ...[truncated 151 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pattern. - Direct users to a versioned release artifact from an authenticated release channel. - Pin a specific reviewed CLI version rather than retrieving a mutable installer. - Download the artifact as a separate step and verify a hard-coded cryptographic checksum and, where available, a publisher signature before execution. - Require explicit user approval before executing the verified installer. - Prefer a trusted operating-system package manager with signed packages and version pinning. - Document the expected files, permissions, and installation effects so users can assess the requested access.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote PowerShell Installer Execution on Windows## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis This instruction uses `Invoke-RestMethod` (`irm`) to retrieve mutable PowerShell source code and passes it directly to `Invoke-Expression` (`iex`). The downloaded content is therefore executed immediately without version pinning, signature validation, checksum verification, or prior inspection. The remote response can change independently of the audited Skill. While installing the CLI is related to the declared functionality, executing an unverified network response is broader and riskier than necessary. HTTPS protects transport under ordinary conditions but does not protect against compromise of the publisher, hosting environment, CDN, DNS, TLS endpoint, or release process. ### Attack Path 1. An attacker compromises or gains control over the content served from `https://cli.oomol.com/install.ps1`. 2. The attacker inserts malicious PowerShell commands into the response. 3. A user or agent follows the first-time setup instruction after the `oo` command is unavailable. 4. `irm` downloads the modified response. 5. The pipeline supplies the response directly to `iex`, which executes it in the current PowerShell process with the invoking user's privileges. ### Impact Assessment Successful exploitation allows arbitrary PowerShell execution as the invoking user. Potential consequences include access to user-readable files and credentials, modification of local configuration or tooling, download and execution of additional payloads, and attempts to establish persistence or escalate privileges. If PowerShell is running with administrative rights, the payload could potentially affect system-wide files, settings, services, and other ...[truncated 6 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` installation pattern. - Publish a versioned, signed Windows package or installer through a trusted distribution channel. - Require Authenticode signature validation and verify a pinned cryptographic checksum before installation. - Separate download, verification, inspection, and execution into distinct steps. - Require explicit user confirmation before running the verified installer. - Prefer a trusted package manager source with package signing and fixed-version installation. - Advise users not to run installation with administrative privileges unless a documented installation step strictly requires them.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 99% confidence
• Finding: The skill instructs users to install software via 'curl ... | bash', which executes a remotely fetched script without prior verification. If the host, network path, or distribution channel is compromised, this becomes an immediate arbitrary code execution vector on the user's machine.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger condition says to use this skill for 'ANY Oomnitza request' and 'instead of calling the API directly,' which is overly broad and can cause the agent to route unrelated, higher-risk, or unsupported Oomnitza tasks through this skill. Overbroad activation increases the chance of misuse, privilege overreach, and accidental execution in contexts not narrowly intended by the skill.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest claims the skill is for 'searching and reading data', but the body explicitly discusses support for state-changing '[write]' and '[destructive]' actions. This mismatch can mislead agents or reviewers into granting the skill broader trust than warranted, increasing the chance that write-capable actions are invoked under a read-only assumption.

Static analysis

No suspicious patterns detected.